Look up IOCs (Indicators of Compromise) of IP addresses, URLs and domains in a local copy of CrowdStrike's curated database of IOCs and annotate the events with the associated security information.

ParameterTypeRequiredDefault ValueDescription
confidenceThresholdstringoptional[a]high The lowest level of confidence of IOCs to consider.
   Valid Values
   highHigh level of confidence that the item is an IOC
   lowLow level of confidence that the item is an IOC
   mediumMedium level of confidence that the item is an IOC
   unverifiedIOC for this item has been reported but not yet verified
field[b]Array of stringsrequired  The field(s) containing either IP addresses, URLs or domains to check for IOCs.
includeArray of stringsoptional[a]All columns Specifies the columns from the IOC database to include.
   Valid Values
   indicatorThe IOC found in the event
   labelsOne or more labels indicating the IOC information
   last_updatedThe date the IOC was last updated
   malicious_confidenceThe confidence level of the IOC, high, medium,low, or unverified
   published_dateThe date the IOC was first published
   typeThe type of the IOC detected, ip_address, url, or domain
prefixstringoptional[a]ioc Prefix for the names of all the output fields.
strictbooleanoptional[a]false If true, only output events where at least one of the selected fields matches an IOC; if false (the default), let all events through.
   Valid Values
   falsePass all events
   trueOnly output events where at least one of the selected fields matches an IOC
typestringrequired  Specifies the type of IOCs to search for a match. Specifying the wrong type may lead to inconsistent or inconclusive results.
   Valid Values
   domainSource value is a domain or hostname
   ip_addressSource value is an IP address
   urlSource value is a URL

[a] Optional parameters use their default value unless explicitly set.

[b] The argument name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Hide negatable operation for this function

Show negatable operation for this function

Important

The ioc:lookup() function cannot be used to lookup custom indicators when deployed within a multi-tenant environment.

If any of the selected fields match an IOC, the field ioc (by default, controlled via the prefix parameter) will be added to each event. If an IOC is identified, the returned information will be an array of values prefix.detected will be added to the event with the value true, where prefix is the value of the prefix argument.

Detailed information on the IOC will then be added to an array ioc (or prefix parameter). For example:

ioc.detectedioc[0].indicatorioc[0].labelsioc[0].last_updatedioc[0].malicious_confidenceioc[0].published_dateioc[0].type
true91.92.242.184KillChain/C2,Malware/AsyncRAT,Malware/Remcos,ThreatType/Commodity,ThreatType/CredentialHarvesting,ThreatType/Criminal,ThreatType/Modular,ThreatType/OpenSource,ThreatType/RAT1706062241000unverified1703421875000ip_address

IP addresses can be either IPv4 or IPv6 addresses. Short-hand notation for IPv6 addresses is supported and can be matched against non-short-hand notation. URLs and domains use case-insensitive string matching.

The function can be negated, but only with strict=true.

For information about how to configure the IOC database, see IOC Configuration.

Returned Fields

The function will set ioc.detected to true for any event that has an identified indicator of compromise. Additional fields then contain specific information about the IOC trigger.

By default, a full set of fields is returned, and because an entry could match one or more IOCs, the information is returned as an array for each of these fields. The returned fields can be limited by using the include argument. For example:

logscale
ioc:lookup(field=[lookupfield], type="domain",include=["labels", "type"])

Might return:

@idioc.detectedioc[0].labelsioc[0].malicious_confidencelookupfield
9ihO66MGBDUAtd1snMEbrWFR_3_44_1709295971trueMaliciousConfidence/High,Malware/AsyncRAT,ThreatType/Commodity,ThreatType/Criminal,ThreatType/Modular,ThreatType/OpenSource,ThreatType/RAThighdoinhulon.ddns.net

The list of fields that can be returned and their contents are described in the table below:

Column Type Description
indicator string The IOC that was found in the event field.
type string The type of IOC detected. One of ip_address, url, and domain.
published_date Timestamp in Unix time, UTC The date the IOC was first published.
last_updated Timestamp in Unix time, UTC The date the IOC was last updated.
malicious_confidence string

The confidence level by which an IOC is considered to be malicious. Will change over time.

  • high: The IOC has been associated with malicious activity within the last 60 days.

  • medium: The IOC has been associated with malicious activity within the last 60-120 days.

  • low: The IOC has been associated with malicious activity exceeding 120 days.

  • unverified: The IOC has not been verified by a CrowdStrike Intelligence analyst or an automated system.

labels string Detailed information about the IOC using a comma-separated list of labels. See Labels.

Labels

The column labels contains a comma-separated list of labels that provide additional context around an indicator. The labels have the form category/value. The categories are described below.

Actors

Have the form Actor/....

The named actor that the indicator is associated with (for example, Panda, Bear, Spider, etc).

Malware Families

Have the form Malware/....

Indicates the malware family an indicator has been associated with (for example, Malware/PoisonIvy, Malware/Zeus, Malware/DarkComet, etc). An indicator may be associated with more than one malware family.

Kill Chains

Have the form KillChain/....

The point in the kill chain at which an indicator is associated.

  • KillChain/Reconnaissance: This indicator is associated with the research, identification, and selection of targets by a malicious actor.

  • KillChain/Weaponization: This indicator is associated with assisting a malicious actor create malicious content.

  • KillChain/Delivery: This indicator is associated with the delivery of an exploit or malicious payload.

  • KillChain/Exploitation: This indicator is associated with the exploitation of a target system or environment.

  • KillChain/Installation: This indicator is associated with the installation or infection of a target system with a remote access tool or other tool allowing for persistence in the target environment.

  • KillChain/C2 (Command and Control): This indicator is associated with malicious actor command and control.

  • KillChain/ActionOnObjectives: This indicator is associated with a malicious actor's desired effects and goals.

Domain Types

Have the form DomainType/....

  • DomainType/ActorControlled: It is believed the malicious actor is still in control of this domain.

  • DomainType/DGA: This domain is the result of malware utilizing a domain generation algorithm.

  • DomainType/DynamicDNS: This domain is owned or used by a dynamic DNS service.

  • DomainType/DynamicDNS/Afraid: This domain is owned or used by the Afraid.org dynamic DNS service.

  • DomainType/DynamicDNS/DYN: This domain is owned or used by the DYN dynamic DNS service.

  • DomainType/DynamicDNS/Hostinger: This domain is owned or used by the Hostinger dynamic DNS service.

  • DomainType/DynamicDNS/noIP: This domain is owned or used by the NoIP dynamic DNS service.

  • DynamicDNS/Oray: This domain is owned or used by the Oray dynamic DNS service.

  • DomainType/KnownGood: The domain itself (or the domain portion of a URL) is known to be legitimate, despite having been associated with malware or malicious activity.

  • DomainType/LegitimateCompromised: This domain does not typically pose a threat but has been compromised by a malicious actor and may be serving malicious content.

  • DomainType/PhishingDomain: This domain has been observed to be part of a phishing campaign.

  • DomainType/Sinkholed: The domain is being sinkholed, likely by a security research team. This indicates that, while traffic to the domain likely has a malicious source, the IP address to which it is resolving is controlled by a legitimate 3rd party. It is no longer believed to be under the control of the actor.

  • DomainType/StrategicWebCompromise: While similar to the DomainType/LegitimateCompromised label, this label indicates that the activity is of a more targeted nature. Oftentimes, targeted attackers will compromise a legitimate domain that they know to be a watering hole frequently visited by the users at the organizations they are looking to attack.

  • DomainType/Unregistered: The domain is not currently registered with any registrars.

IP Address Types

Have the form IPAddressType/....

  • IPAddressType/HtranDestinationNode: An IP address with this label is being used as a destination address with the HTran Proxy Tool.

  • IPAddressType/HtranProxy: An IP address with this label is being used as a relay or proxy node with the HTran Proxy Tool.

  • IPAddressType/LegitimateCompromised: It is suspected an IP address with this label is compromised by malicious actors.

  • IPAddressType/Parking: This IP address is likely being used as parking IP address.

  • IPAddressType/PopularSite: This IP address could be utilized for a variety of purposes and may appear more frequently than other IPs.

  • IPAddressType/SharedWebHost: This IP address may be hosting more than one website.

  • IPAddressType/Sinkhole: This IP address is likely a sinkhole being operated by a security researcher or vendor.

  • IPAddressType/TorProxy: This IP address is acting as a TOR (The Onion Router) Proxy.

Status

Have the form Status/....

  • Status/ConfirmedActive: This indicator is likely to be currently supporting malicious activity.

  • Status/ConfirmedInactive: This indicator is no longer used for malicious purposes.

  • Status/Historic: The indicator is no longer used for malicious purposes but could be used again in the future.

Target

Have the form Target/....

The activity associated with this indicator is known to target the indicated vertical sector, which could be any of the following:

  • Target/Aerospace

  • Target/Agricultural

  • Target/Chemical

  • Target/Defense

  • Target/Dissident

  • Target/Energy

  • Target/Extractive

  • Target/Financial

  • Target/Government

  • Target/Healthcare

  • Target/Insurance

  • Target/InternationalOrganizations

  • Target/Legal

  • Target/Manufacturing

  • Target/Media

  • Target/>NGO

  • Target/Pharmaceutical

  • Target/Research

  • Target/Retail

  • Target/Shipping

  • Target/Technology

  • Target/Telecom

  • Target/Transportation

  • Target/Universities

Threat Type

Have the form ThreatType/....

  • ThreatType/ClickFraud: This indicator is used by actors engaging in click or ad fraud

  • ThreatType/Commodity: This indicator is used with commodity type malware such as Zeus or Pony Downloader.

  • ThreatType/PointOfSale: This indicator is associated with activity known to target point-of-sale machines such as AlinaPoS or BlackPoS.

  • ThreatType/Ransomware: This indicator is associated with ransomware malware such as Crytolocker or Cryptowall.

  • ThreatType/Suspicious: This indicator is not currently associated with a known threat type but should be considered suspicious.

  • ThreatType/Targeted: This indicator is associated with a known actor suspected to associated with a nation-state such as DEEP PANDA or ENERGETIC BEAR.

  • ThreatType/TargetedCrimeware: This indicator is associated with a known actor suspected to be engaging in criminal activity such as WICKED SPIDER.

Vulnerability

Have the form Vulnerability/....

The CVE-XXXX-XXX vulnerability the indicator is associated with (for example, Vulnerability/CVE-2012-0158).

Testing

If you use this function in a query and it does not produce any IOC results, it can be hard to tell whether there were no results or there is an error in the query. To help with that, we provide some sample IOCs that you can test your query with:

Type Sample
IP address 185.193.127.134
Domain xboxapicenter.com
URL http://5.45.70.137/stats/getinfo.php

Since the IOC database is updated constantly, we cannot guarantee that these remain in the database. If you believe that one of them is no longer in the database, please contact us. Also, the malicious_confidence of these IOCs will probably be lowered over time.

For example, to test the IP address you can run the query:

logscale
client_ip:="38.92.47.91"
| ioc:lookup(field=[client_ip],type="ip_address",confidenceThreshold=unverified)

Might output:

ioc[0].indicatorioc[0].labelsioc[0].last_updatedioc[0].malicious_confidenceioc[0].published_dateioc[0].type
1729191752000Actor/FAMOUSCHOLLIMA,KillChain/C2,MaliciousConfidence/High,Malware/BeaverTail,Malware/InvisibleFerret,ThreatType/CredentialHarvesting,ThreatType/RAT,ThreatType/Targeted1729196639000high1729191752000ip_address

ioc:lookup() Examples

Look up IP address IOCs for the field ip and annotate events with the associated security information.

logscale
ioc:lookup("ip", type=ip_address)

Without explicitly setting different arguments, the default for these settings will be used. For example, confidenceThreshold will be applied with the high setting. Care should be taken to ensure that appropriate settings are used when matching against the IOC database.

In the above example, this would mean the function would only return if the IP address was marked with a confidence threshold of high, and may not return anything at all.

Explicitly specifying fields that should be returned will provide more detail, such as malicious_confidence:

logscale
ioc:lookup("ip", type=ip_address, include=["malicious_confidence", "labels"])

To explicitly lower the threshold for returned queries:

logscale
ioc:lookup("ip", type=ip_address, confidenceThreshold="low" )

Use the prefix detection for returned fields: any added fields.

logscale
ioc:lookup("ip", type="ip_address", prefix="detection")

Look up URL IOCs for the field url and search IOCs of all confidence levels.

logscale
ioc:lookup("url", type="url", confidenceThreshold="low")

Look up URL IOCs for the field url and only keep the events containing an IOC. Useful for finding IOCs in queries used for alerts or scheduled searches.

logscale
ioc:lookup("url", type="url", strict=true)