Google Threat Intelligence

New Feature for Saved IOC Searches:  We have enhanced the Intelligence Search workflow to eliminate repetitive manual entry. Threat hunters can now build complex queries once and save them for future use. This allows teams t

 This Google Threat Intelligence search query is designed to identify files submitted from specific countries, along with community feedback indicating the presence of a Ransom note, which strongly suggests a potential victim from that country and is sharing that intelligence. submitter:DE comment:"SUSP_RANSOM_Note" 

 This Google Threat Intelligence search query uses a high-fidelity byte signature to instantly identify LockBit 3.0 ELF ransomware samples. content:{34043B5C0B8CFB1AEEDB995A9AA9EE19F9AA9AEE9A09DACA299AAAEE6E09F9EE9A69A99A09B95AF909EEBA6ADA097A9AB95E5000F30668841826EF11C041B0CFA3C0AE5E4FA36E5EAE7E8F2F4FA3CEAE5F4F01A3535FA323A2D1

 This Google Threat Intelligence search query is designed to hunt for malicious files that attempt to confuse, manipulate, or evade security Large Language Models (LLMs) by embedding specific adversarial commands or "jailbreak" phrases. entity:file (crowdsourced_ai_analysis:"DAN" or crowdsourced_ai_analysis:"ignore previous instructions" or cro

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

Hello Google Cloud Community,I would like to clarify a point regarding Google SecOps licensing.I have been reviewing the official documentation, including the "Applied Threat Intelligence overview" and "Emerging Threats overview." The documentation states that the Applied Threat Intelligence (ATI) and Emerging Threats features are available with the Google SecOps Enterprise Plus license.However, it is not entirely clear whether these features are excluded from the Enterprise license.Could someone please confirm my understanding?Is it correct that the Applied Threat Intelligence and Emerging Threats features are unavailable with the Enterprise license? Is the Enterprise Plus license strictly required to use them?Thank you in advance for your help.

Hi TeamAm looking to create outbound rule  from firewall to the GCTI IP.  So using the below lines in my rule as suggested by the SECOPS. Expecting your support on this for better understanding.    $feed.graph.metadata.entity_type = "IP_ADDRESS"    $feed.graph.metadata.product_name = "GCTI Feed"    $feed.graph.metadata.source_type = "GLOBAL_CONTEXT" 1. I would like to know how to validate the above lines and its values. If i do the UDM search i can able to see the   graph.metadata.source_type = "DERIVED_CONTEXT" and not the graph.metadata.source_type = "GLOBAL_CONTEXT"Since i have the source type : Mandiant Threat Intelligence. (Refer : Below Snap-2)  3. How i can confirm GCTI feeds are integrated. 4. Is the feeds are updated at any frequency or feeds are updated live. Snap:1

 Day 4: Hunting Gamaredon-Related Document Activity This Google Threat Intelligence search query is designed to find files that match a specific set of characteristics, generally indicative of a particular type of malware or activity. (type:document) and (behavior_processes:*.ru* and behavior_processes:*DavSetCookie* and behavior_processes:*http*) and (behavior_network:*.ru* or embedded_domain:*.ru* or embedded_url:*.ru*)  

 Day 1: Google Threat Intelligence search a day keeps the phishing away… This Google Threat Intelligence search query is designed to find potentially malicious or misleading domains that are similar to netflix.com but are not the official domain itself. entity:domain fuzzy_domain:netflix.com and not domain:netflix.com creation_date:90d+  Query Breakdown: The query uses specific search modifiers (

 This query is designed to identify and block the Command and Control (C2) domains used by the Gamaredon (also known as Primitive Bear or UAC-0010) threat actor, a highly persistent group with reported ties to Russia, often targeting entities in Ukraine. entity:url tld:ru path:"/DESKTOP-*" (have:communicating_file or have:refer

 This sophisticated search is designed to unmask active file delivery domains used by threat actors in targeted espionage campaigns against sensitive UK sectors like the Ministry of Defence (MOD), National Health Service (NHS), and His Majesty's Revenue and Customs (HMRC). entity:url (hostname:"*-govuk*" or hostname:"*mod-uk*"

 This search is designed to identify files that use a specific, hardcoded User-Agent string during their dynamic analysis, which is the tell-tale signature of a Cobalt Strike beacon attempting covert Command and Control (C2) communication. entity:file behavior:"Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

 This targeted search is designed to hunt for files that are high-conviction malware but still rely on a valid, non-revoked digital signature. This often points directly to newly stolen code-signing certificates or fresh, high-trust payloads. tag:signed not tag:revoked-cert not tag:invalid-signature p:5+

 This search identifies files whose malware configuration contains SMTP or IMAP fields, which typically indicates the malware uses an email-based mechanism for communication or data exfiltration. malware_config:"smtp" or malware_config:"imap" Quer

 This targeted search is designed to provide an efficient, daily list of files that are newly uploaded, validated with multiple antivirus detections and high-quality sandbox reports, yet currently lack Sigma rule matches. This allows detection engineers to prioritize coverage gaps in their security monitoring infrastructure. p:5+ (sandbox_name:

 This search query is designed to hunt for newly created or emerging malware that specifically targets information (stealers) by leveraging Program Database (PDB) file metadata which is often overlooked but can contain revealing developer-left strings. entity:file metadata:".pdb" metadata:"stealer" p:5+ fs:30d+

 This Google Threat Intelligence search query is designed to identify newly created, algorithmically generated domains (DGA) with multiple positive detections, which were registered through a registrar frequently abused by threat actors. entity:domain p:5+ tag:dga registrar:"NICENIC INTERNATIONAL GROUP CO., LIMITED" creation_da

 This VirusTotal Intelligence search query is designed to identify IP addresses acting as potential Command and Control (C2) servers. It specifically targets infrastructure that is serving or being contacted by a small number of malicious files and uses newly issued self-signed SSL certificates—a strong signal of newly deployed or low-profile C2 infrastructure. 

 This Google Threat Intelligence search query is designed to find files that execute specific obfuscated PowerShell commands to download malicious payloads. This query relies on sandboxed behavioral analysis to detect the command at runtime, bypassing static obfuscation that can often evade simple scanners. behavior:"'; &('

 This Google Threat Intelligence search query is designed to identify currently active Dropbox URLs that directly download files and are already confirmed to be suspicious by multiple antivirus engines. entity:url url:dropboxusercontent response_code:200 have:downloaded_file p:3+ fs:7d+ Quer

Obtaining Google Threat Intelligence's unique attributes from the APITo successfully obtain the gti_assessment attribute within the JSON response, the inclusion of the x-tool header in your request is a critical requirement. This header is essential for uniquely identifying your specific tool or service. Without this vital component, the API will be unable to process your request correctly and, consequently, the gti_assessment attribute will not be returned in the JSON payload. Ensure that the x-tool header accurately reflects the identifier of your application or service to guarantee proper API functionality and data retrieval. The x-tool headerThe "x-tool" header is a critical component for authenticating and identifyi

 I have had a lot of trouble getting Lucene Text Queries to work in DTM Monitors. I have referenced the below pages and still have issues finding the info I need. I discovered you can search for individual Monitor Topic entity types (ex. “domain” entity type instead of entire Network Information), but this was from trial and error, the documentation does not write out this capability or the syntax it needs to be in. Also sections like “doc_type” values are not documented (ex. Shop Listings must be “shop_list”). There is also the Conditionals like “must contain” and many more, I cannot find how to add these values into Lucene Text Queries.Your Adoption Guide uses examples like:__type:"shop_listing" AND item_type:"CC"  messenger.name:telegram AND sender.telegram.user_id:6273****** email.headers.value:"@os-kh.de"I cannot find where these syntax requirements come from or the key values (why __type and where does item_type come fro