suspicious_writes_lookup Threat Intel

[Scott_Kudelski]

Hi All,

First time poster, so not sure if this is the right location.

Looking for a public feed that would updated the "suspicious_writes_lookup".  This lookup is used for "ESCU - Suspicious File Write - Rule" but only contains hidden cobra info by default.

[richgalloway · Accepted solution]

The notes for that rule say 

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.

 Notice there is no mention of a public feed.  All of the data needed for this rule must come from local sources.

[Scott_Kudelski]

@richgalloway  Thanks for the reply.

I had read the notes about this rule.  Since the "stub" lookup has information from "Hidden Cobra", I was hoping to find a feed that would have other files for different APTs. 

We are currently working to get our own intel into this file, but was looking for more than just our findings.

[rvany]

Is this for Enterprise Security? Maybe you get better results if you add the label accordingly.