TweetFeed

Feeds of IOCs posted by the community at Twitter

TweetFeed.live | Source code | Feedback

Want to integrate with OpenCTI? Now you can!

☰ Content

Data collected
Some statistics
How it works
Hunting IOCs via Microsoft Defender
Author
Disclaimer

❤️ Support the project

If you like the project, please consider:

Giving it a star ⭐
Invite to a coffee ☕

📄 Data collected

Feeds

2024-06-11 15:20:51 (UTC)
Today	Last 7 days	Last 30 days	Last 365 days
📋 Today (raw)	📋 Week (raw)	📋 Month (raw)	📋 Year (raw)

Output example

_{Date (UTC)}	_SourceUser	_Type	_Value	_Tags	_Tweet
_{2021-08-14 02:26:32}	_{phishunt_io}	_url	_{https://netflix.us2.cards/}	_{#phishing #scam}	_{https://twitter.com/phishunt_io/status/1426369619422502917}
_{2021-08-17 12:15:00}	_{TheDFIRReport}	_ip	_185.56.76.94	_#Trickbot	_{https://twitter.com/TheDFIRReport/status/1427604874053578756}

📊 Some statistics

Types

Type	Month	Year
🔗 URLs	2782	33982
🌐 Domains	1454	18293
🚩 IPs	1173	15418
🔢 SHA256	199	4563
🔢 MD5	95	1346

Tag	Month	Year
#phishing	2253	40397
#scam	27	1967
#opendir	60	335
#malware	151	3103
#maldoc	0	16
#ransomware	29	187
#banker	3	10
#AgentTesla	5	73
#Alienbot	0	0
#AsyncRAT	4	116
#Batloader	0	0
#BazarLoader	0	3
#CobaltStrike	891	8951
#Dcrat	46	540
#Emotet	0	4
#Formbook	3	15
#GootLoader	5	132
#GuLoader	4	23
#IcedID	0	62
#Lazarus	0	37
#Lokibot	74	244
#log4j	0	0
#Log4shell	0	0
#Njrat	170	1475
#Qakbot	87	1531
#Raccoon	0	1
#RedLine	15	280
#Remcos	20	279
#RaspberryRobin	0	18
#Spring4Shell	0	0
#SocGolish	0	7
#Ursnif	0	15

Top Reporters (today)

Number	User	IOCs
#1	-	0
#2	-	0
#3	-	0
#4	-	0
#5	-	0
#6	-	0
#7	-	0
#8	-	0
#9	-	0
#10	-	0

❓ How it works?

Search tweets that contain certain tags or that are posted by certain infosec people.

Tags being searched

(not case sensitive)

- #phishing
- #scam
- #opendir
- #malware
- #maldoc
- #ransomware
- #banker
- #AgentTesla
- #Alienbot
- #AsyncRAT
- #BazarLoader
- #Batloader
- #CobaltStrike
- #Dcrat
- #Emotet
- #Formbook
- #GootLoader
- #GuLoader
- #IcedID
- #Lazarus
- #Lokibot
- #log4j
- #Log4shell
- #Njrat
- #Qakbot
- #Raccoon
- #RedLine
- #Remcos
- #RaspberryRobin
- #Spring4Shell
- #SocGholish
- #Ursnif

Also search Tweets posted by

(these are trusted folks that sometimes don't use tags)

TweetFeed list

🔍 Hunting IOCs via Microsoft Defender

1. Search SHA256 hashes with yearly tweets feed

let MaxAge = ago(30d);
let SHA256_whitelist = pack_array(
'XXX' // Some SHA256 hash you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'sha256'
    | extend SHA256 = tostring(report[3])
    | where SHA256 !in(SHA256_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project SHA256, Tag, Tweet 
);
union (
    TweetFeed
    | join (
        DeviceProcessEvents
        | where Timestamp > MaxAge
    ) on SHA256
), (
    TweetFeed
    | join (
        DeviceFileEvents
        | where Timestamp > MaxAge
    ) on SHA256
), ( 
    TweetFeed
    | join (
        DeviceImageLoadEvents
        | where Timestamp > MaxAge
    ) on SHA256
) | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Tag, Tweet

2. Search IP addresses with monthly tweets feed

let MaxAge = ago(30d);
let IPaddress_whitelist = pack_array(
'XXX' // Some IP address you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'ip'
    | extend RemoteIP = tostring(report[3])
    | where RemoteIP !in(IPaddress_whitelist)
    | where not(ipv4_is_private(RemoteIP))
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteIP, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteIP
) | project Timestamp, DeviceName, RemoteIP, Tag, Tweet

3. Search urls and domains with weekly tweets feed

let MaxAge = ago(30d);
let domain_whitelist = pack_array(
'XXX' // Some URL/Domain you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type in('url','domain')
    | extend RemoteUrl = tostring(report[3])
    | where RemoteUrl !in(domain_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteUrl, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteUrl
) | project Timestamp, DeviceName, RemoteUrl, Tag, Tweet

👤 Author

Daniel López

📌 Disclaimer

Please note that all the data is collected from Twitter and sorted/served here as it is on best effort.

I have tried to tune as much as possible the searches trying to collect only valuable info. However please consider making your own analysis before taking any action related to these IOCs.

Anyway feel free to reach me out or to provide any kind of feedback regarding any contribution or suggestion.

By the community, for the community.

0xdaniellopez / tweetfeed Goto Github PK

tweetfeed's Introduction

TweetFeed

Feeds of IOCs posted by the community at Twitter

Want to integrate with OpenCTI? Now you can!

☰ Content

❤️ Support the project

📄 Data collected

Feeds

Output example

📊 Some statistics

Types

Tags

Top Reporters (today)

❓ How it works?

Tags being searched

(not case sensitive)

Also search Tweets posted by

(these are trusted folks that sometimes don't use tags)

🔍 Hunting IOCs via Microsoft Defender

👤 Author

📌 Disclaimer

tweetfeed's People

Contributors

Stargazers

Watchers

Forkers

tweetfeed's Issues

Recommend Projects

Recommend Topics

Recommend Org

Jobs