Look up IOCs (Indicators of Compromise) of IP addresses, URLs and domains in a local copy of CrowdStrike's curated database of IOCs and annotate the events with the associated security information.
|string||false||high||The lowest level of confidence of IOCs to consider.|
|[string]||true||The field(s) containing either IP addresses, URLs or domains to check for IOCs. [a]|
|[string]||false||All columns||Specifies the columns from the IOC database to include.|
|string||false||ioc||Prefix for the names of all the output fields.|
|Valid Values||false||Pass all events|
|true||Only output events where at least one of the selected fields matches an IOC|
|string||true||Specifies the type of IOCs to look for.|
If any of the selected fields match an IOC, the field
<prefix>.detected will be added
with the value
<prefix> is the value of the
prefix argument. Also, for each field matching an IOC,
there will be added fields
<index> is the first
unused index, starting with 0, and
column is one of the column names
selected by the
IP addresses can be either IPv4 or IPv6 addresses. Short-hand notation for IPv6 addresses is supported and can be matched against non-short-hand notation. URLs and domains use case-insensitive string matching.
The function can be negated, but only with
For information about how to configure the IOC database, see IOC Configuration.
|indicator||string||The IOC that was found in the event field.|
The type of IOC detected. One of
|published_date||Timestamp in Unix time, UTC||The date the IOC was first published.|
|last_updated||Timestamp in Unix time, UTC||The date the IOC was last updated.|
The confidence level by which an IOC is considered to be
malicious. Will change over time.
|labels||string||Detailed information about the IOC, see below.|
labels contains a
comma-separated list of labels that provide additional context around an
indicator. The labels have the form
category/value. The categories are
Have the form "Actor/...".
The named actor that the indicator is associated with (e.g. "Panda", "Bear", "Spider", etc).
Have the form "Malware/...".
Indicates the malware family an indicator has been associated with (e.g. "Malware/PoisonIvy", "Malware/Zeus", "Malware/DarkComet", etc). An indicator may be associated with more than one malware family.
Have the form "KillChain/...".
The point in the kill chain at which an indicator is associated.
Reconnaissance: This indicator is associated with the research, identification, and selection of targets by a malicious actor.
Weaponization: This indicator is associated with assisting a malicious actor create malicious content.
Delivery: This indicator is associated with the delivery of an exploit or malicious payload.
Exploitation: This indicator is associated with the exploitation of a target system or environment.
Installation: This indicator is associated with the installation or infection of a target system with a remote access tool or other tool allowing for persistence in the target environment.
C2(Command and Control): This indicator is associated with malicious actor command and control.
ActionOnObjectives: This indicator is associated with a malicious actor's desired effects and goals.
Have the form "DomainType/...".
ActorControlled: It is believed the malicious actor is still in control of this domain.
DGA: This domain is the result of malware utilizing a domain generation algorithm.
DynamicDNS: This domain is owned or used by a dynamic DNS service.
DynamicDNS/Afraid: This domain is owned or used by the Afraid.org dynamic DNS service.
DynamicDNS/DYN: This domain is owned or used by the DYN dynamic DNS service.
DynamicDNS/Hostinger: This domain is owned or used by the Hostinger dynamic DNS service.
DynamicDNS/noIP: This domain is owned or used by the NoIP dynamic DNS service.
DynamicDNS/Oray: This domain is owned or used by the Oray dynamic DNS service.
KnownGood: The domain itself (or the domain portion of a URL) is known to be legitimate, despite having been associated with malware or malicious activity.
LegitimateCompromised: This domain does not typically pose a threat but has been compromised by a malicious actor and may be serving malicious content.
PhishingDomain: This domain has been observed to be part of a phishing campaign.
Sinkholed: The domain is being sinkholed, likely by a security research team. This indicates that, while traffic to the domain likely has a malicious source, the IP address to which it is resolving is controlled by a legitimate 3rd party. It is no longer believed to be under the control of the actor.
StrategicWebCompromise: While similar to the
DomainType/LegitimateCompromisedlabel, this label indicates that the activity is of a more targeted nature. Oftentimes, targeted attackers will compromise a legitimate domain that they know to be a watering hole frequently visited by the users at the organizations they are looking to attack.
Unregistered: The domain is not currently registered with any registrars.
IP Address Types
Have the form "IPAddressType/...".
HtranDestinationNode: An IP address with this label is being used as a destination address with the HTran Proxy Tool.
HtranProxy: An IP address with this label is being used as a relay or proxy node with the HTran Proxy Tool.
LegitimateCompromised: It is suspected an IP address with this label is compromised by malicious actors.
Parking: This IP address is likely being used as parking IP address.
PopularSite: This IP address could be utilized for a variety of purposes and may appear more frequently than other IPs.
SharedWebHost: This IP address may be hosting more than one website.
Sinkhole: This IP address is likely a sinkhole being operated by a security researcher or vendor.
TorProxy: This IP address is acting as a TOR (The Onion Router) Proxy.
Have the form "Status/...".
ConfirmedActive: This indicator is likely to be currently supporting malicious activity.
ConfirmedInactive: This indicator is no longer used for malicious purposes.
Historic: The indicator is no longer used for malicious purposes but could be used again in the future.
Have the form "Target/...".
The activity associated with this indicator is known to target the
indicated vertical sector, which could be any of the following: -
Have the form "ThreatType/...".
ClickFraud: This indicator is used by actors engaging in click or ad fraud
Commodity: This indicator is used with commodity type malware such as Zeus or Pony Downloader.
PointOfSale: This indicator is associated with activity known to target point-of-sale machines such as AlinaPoS or BlackPoS.
Ransomware: This indicator is associated with ransomware malware such as Crytolocker or Cryptowall.
Suspicious: This indicator is not currently associated with a known threat type but should be considered suspicious.
Targeted: This indicator is associated with a known actor suspected to associated with a nation-state such as DEEP PANDA or ENERGETIC BEAR.
TargetedCrimeware: This indicator is associated with a known actor suspected to be engaging in criminal activity such as WICKED SPIDER.
Have the form "Vulnerability/...".
The CVE-XXXX-XXX vulnerability the indicator is associated with (e.g. "Vulnerability/CVE-2012-0158").
If you use this function in a query and it does not produce any IOC results, it can be hard to tell whether there were no results or there is an error in the query. To help with that, we provide some sample IOCs that you can test your query with:
Note that since the IOC database is updated constantly, we cannot
guarantee that these remain in the database. If you believe that one of
them is no longer in the database, please contact us. Also, the
malicious_confidence of these IOCs
will probably be lowered over time. If you have a query using the
ioc:lookup() function on the field
client_ip, you can alter that
query and add
client_ip:="220.127.116.11" to the
query before the
ioc:lookup() function to have it
match a known IOC. You might need to add
argument to the
ioc:lookup() function in order to
find this IOC.
Look up IP address IOCs for the field
ip and annotate events with the
associated security information.
Only include the columns
ioc:lookup("ip", type=ip_address, include=["malicious_confidence", "labels"])
Use the prefix
detection as prefix
for any added fields.
ioc:lookup("ip", type="ip_address", prefix="detection")
Look up URL IOCs for the field
and search IOCs of all confidence levels.
ioc:lookup("url", type="url", confidenceThreshold="low")
Look up URL IOCs for the field
and only keep the events containing an IOC. Useful for finding IOCs in
queries used for alerts or scheduled searches.
ioc:lookup("url", type="url", strict=true)