threatinfo – Threat Intelligence

NiFi Groovy Script to Find 1st and Last IPs in Subnet

Takes a subnet cidr from a flowfile attribute called subnetCidr as shown below and returns the first and last usable IP addresses as attributes Add the below code into the script…

threatinfo April 23, 2025

Threat Intelligence

Unusual user agent VPN attempts CitrixReceiver/23.11.1.41 Windows/10.0 AuthManager/23.11.0.9 (Release) X1Class CWACapable CWA/23.11.1.41

We're seeing unusual patterns of login attempts against our customers netscalers with the only thing in common the user-agent: CitrixReceiver/23.11.1.41 Windows/10.0 AuthManager/23.11.0.9 (Release) X1Class CWACapable CWA/23.11.1.41 Some are brute force…

threatinfo December 26, 2024

Threat Intelligence

Netscaler Credential Stuffing Attack

We have recently identified another new persistent citrix netscaler credential stuffing attack against one of our customers using recently compromised credentials from users who had fallen victim to infostealers. This…

threatinfo December 24, 2024

sentinel Threat Intelligence

Credential stuffing attacks against Azure Portal from Set User Agent and Device

We have recently identified a persistent credential stuffing attack against some of our customers. Credential stuffing is a cyberattack method in which attackers use lists of compromised user credentials to breach into a system.…

threatinfo December 17, 2024

Nifi sentinel Threat Intelligence

Pushing Bulk Indicators to Multiple Sentinel Instances for a MSSP

Problem We manage a MISP instance which receives over 130,000 IOCs every day from multiple sources which we need to push to over 22 Microsoft Sentinel instances which we manage.…

threatinfo November 29, 2024

Defender Nifi

Microsoft Defender Indicator API Always Generates Alerts

No matter how hard I try, I cannot get the Microsoft Defender Indicator API https://api.securitycenter.microsoft.com/api/indicators/import to import IOCs with the Generate alert flag off. I have tried the below to no…

threatinfo November 29, 2024

Nifi

Configuring Nifi with Azure Key Vault Secrets Parameter Providers

To integrate Nifi with an Azure Key Vault follow the below steps Step 1 - Add Parameter Provider Go into Controller Settings -> Parameter Providers and add an AzureKeyVaultSecretsParameterProvider as…

threatinfo October 4, 2024

Threat Intelligence

Actor targeting Palo Alto VPN

User names used by actor seen using VPNs with Canadian source IP addresses 10/05/2024. Replace targetDomain below with the domain of the VPN service (i.e. victim Domain) monitor paservice@targetDomain admin@targetDomain…

threatinfo May 12, 2024

logstash sentinel siem

SIEM Log Ingestion – To filter or to deduplicate

Why Should You Manage Your Log Ingestion? Cost Implications SIEM tools operate under a licensing model that typically charges based on the volume of logs ingested. Ingesting a high volume…

threatinfo April 24, 2024

sentinel siem

Sentinel Parsing Data at Ingestion or at Query time

There are different options for parsing data in Microsoft Sentinel. Query time parsing when the parsing is done when an analytic or analyst executes a piece of KQL or Ingest…

threatinfo April 1, 2024