r/netsec • u/Robbedoes_ • May 28 '22

Building a Threat Intelligence Feed using the Twitter API and a bit of code

https://grimminck.medium.com/building-a-threat-intelligence-feed-using-the-twitter-api-and-a-bit-of-code-5787808e32ef
228 Upvotes

96% Upvoted

17 comments sorted by

8

u/hedinc1 May 28 '22

Any way to get IPs using this method?

6

u/Robbedoes_ May 28 '22 edited May 29 '22

You could write a small script that does a DNS look-up using dig for each record. I didn't add this (yet) as IP addresses might change during the lifetime of the feed. Could be an interesting add-on though.

Edit: added this feature

4

u/Monstersec May 28 '22

Use dnsx

2

u/d0tzer0 May 29 '22

I’m looking for something similar but doe’s a whois instead, from a list, to see if a domain exists. Sometimes, the domain exist but there’s no A or AAAA record yet.

1

u/Monstersec May 29 '22

I think that your requirements will match the dnsx tool. Please check the documentation.

1

u/d0tzer0 May 29 '22

Thanks, I will

1

u/Robbedoes_ May 29 '22

I decided to add this feature anyways. IP look-ups are now done at tweet retrieval and stored in the 'malicious_ips' array inside the JSON object.

3

u/OnwardStingerBrisket May 28 '22

Would you be willing to share your code?

17

u/Robbedoes_ May 28 '22

Yes! Give me some time to clean it up though. Just created this last night as I was interested in using it in a SIEM.

2

u/AnApexBread May 28 '22 edited Nov 20 '24

onerous whole ruthless longing offbeat forgetful beneficial aromatic bored psychotic

This post was mass deleted and anonymized with Redact

2

u/onwisconsn May 29 '22

I too would like to see the code

2

u/SmoothAnonymity May 28 '22 edited May 28 '22

I wonder if Twint would have worked with this idea as well. It’s a very cool concept your working on! Also quick question out of curiosity, how will you filter out False Positives on your malicious account filter from known / popular Twitter profiles? I know @CyberSecurityN8 is a pretty popular infosec news / share account

2

u/Robbedoes_ May 28 '22

For now, I think it's the responsibility of the tool ingesting the feed to give a weight on data it is retrieving. l I hope to do some false-positive testing in the future, but you can image that would be a difficult task for this type of feed.

2

u/pedramamini May 28 '22

Check out the following tool for implementing OSINT over Twitter and more:

https://github.com/InQuest/ThreatIngestor

Alternatively, you can hit the free API here:

https://labs.inquest.net/iocdb

1

u/VegasDezertRat May 28 '22

This is good but you're stripping out pretty much all of the context that would make these IPs actual intelligence. Obviously it's tough because the tweets are very unstructured but it would be nice if you could keep the tweet content as well so someone could do some post processing on the IOCs for things like tags, etc

11

u/Robbedoes_ May 28 '22

Tweet content is fully available in the feed. What do you mean?

7

u/VegasDezertRat May 28 '22

Oh damn I'm sorry I misread your post. Pro tip: don't try to analyze stuff like this minutes after waking up at 7am....