KELA's Technical Cybercrime Intelligence

As part of its ongoing mission to empower organizations to neutralize cyber threats, KELA introduces its Technical Cybercrime Intelligence: automatic detection of potentially compromised IPs and domains involved in cybercrime activity, detected in cybercrime sources such as closed forums, illicit markets, automated cybercrime shops, instant messaging channels used by criminals, and more. This intelligence is available to consume via Snowflake as a machine-readable feed and can be easily integrated into your security appliances. Use KELA’s Technical Intelligence to monitor the latest compromised network assets that can be exploited by threat actors for their next cyber attack. Such assets can be abused to serve as an attack infrastructure (for example, as a C2 server) or as an attack vector such as phishing attacks. Easily integrate KELA's Technical Cybercrime Intelligence into your SIEM, SOAR, or any other security solution, and get full coverage of your cybercrime attack surface to protect your organization from potential threats before they cause harm. Tables: - Observables Fields Included: - IP/Domain - Description - STIX Pattern - STIX object - Source info作为赋能组织抵御网络威胁的长期使命之一，KELA推出其网络犯罪技术情报：可自动检测涉网络犯罪活动的疑似受感染IP与域名，此类威胁信号源自暗网论坛、非法市场、自动化网络犯罪工坊、犯罪分子使用的即时通讯频道等多种网络犯罪来源渠道。该情报可通过Snowflake以机器可读馈送的形式获取，并可轻松集成至您的安全设备中。 借助KELA的技术情报，您可监控最新被攻陷的网络资产——这些资产可能被威胁行为者利用，作为下一阶段网络攻击的跳板：既可以充当命令与控制（Command and Control, C2）服务器这类攻击基础设施，也可作为钓鱼攻击等攻击载体。 您可轻松将KELA的网络犯罪技术情报集成至安全信息和事件管理（Security Information and Event Management, SIEM）、安全编排自动化与响应（Security Orchestration, Automation, and Response, SOAR）或其他任意安全解决方案中，全面覆盖您的网络犯罪攻击面，从而在潜在威胁造成损害前提前保护组织安全。 数据集表格： - 可观测指标（Observables） 包含字段： - IP/域名 - 描述信息 - STIX模式（STIX Pattern） - STIX对象（STIX object） - 来源信息

搜集汇总

背景与挑战

背景概述

该数据集提供自动检测的网络犯罪相关IP和域名情报，数据源自犯罪论坛等渠道，可通过Snowflake集成至安全设备，用于监控潜在攻击资产并预防网络威胁。包含IP/域名、描述等字段的Observables表。