Abuse.ch Malware Submissions (MD5)
TI Feed Abuse Chmd5malware
Query
let MalwareSampleMD5 = externaldata(MD5: string)[@"https://bazaar.abuse.ch/export/txt/md5/recent"] with (format="txt", ignoreFirstRecord=True);
let MD5Regex = '[a-f0-9]{32}';
let MaliciousMD5 = materialize (
MalwareSampleMD5
| where MD5 matches regex MD5Regex
| distinct MD5
);
DeviceFileEvents
| where MD5 has_any (MaliciousMD5)About this query
Abuse.ch Malware Submissions (MD5)
Source: Abuse.ch
Feed information: https://bazaar.abuse.ch/faq/#tos
Feed link: https://bazaar.abuse.ch/export/txt/md5/recent/
Defender XDR
Sentinel
let MalwareSampleMD5 = externaldata(MD5: string)[@"https://bazaar.abuse.ch/export/txt/md5/recent"] with (format="txt", ignoreFirstRecord=True);
let MD5Regex = '[a-f0-9]{32}';
let MaliciousMD5 = materialize (
MalwareSampleMD5
| where MD5 matches regex MD5Regex
| distinct MD5
);
DeviceFileEvents
| where MD5 has_any (MaliciousMD5)
Explanation
This query is designed to identify potentially malicious files on devices by comparing their MD5 hashes against a list of known malware samples. Here's a simple breakdown of what the query does:
-
Data Source: It retrieves a list of MD5 hashes from the Abuse.ch malware database, specifically from a recent export of known malware samples.
-
Format and Filtering: The data is imported in text format, and the first record is ignored. A regular expression (
MD5Regex) is used to ensure that only valid MD5 hashes (32-character hexadecimal strings) are considered. -
Materialization: The valid MD5 hashes are then stored in a temporary table called
MaliciousMD5, ensuring that each hash is unique. -
Comparison with Device Events: The query then checks the
DeviceFileEventstable for any file events where the MD5 hash of a file matches any of the hashes in theMaliciousMD5list.
In summary, this query helps in detecting files on devices that have MD5 hashes matching known malware samples, aiding in threat detection and response efforts.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators