Ask IFIN: Dynamic Block Lists

General
,
1

One of the goals for low-on-the-pyramid intelligence is to automatically ingest and block IPs/domains/hashes from intel feeds.

So some questions on this.

  1. Where do you send your block lists?
  2. How large are your custom block lists?
  3. Do you monitor overlap between generated lists? How?
  4. Do you age out your indicators? How long do they live?
  5. Do your lists include wildcards (i.e. *.evilsite.com). How do you produce those?

Feel free to pivot off this question to related block list topics.

2

1 - Firewalls, DNS, EDR / XDR

2 - In the millions for IPs and domains. Less for hashes since so many of them are in the threat feeds for the vendors.

3 - No. Example: An IP might be on a blocklist for a botnet. Then if the botnet is taken down, the botnet list may be removed as well. But it may still need to stay in another list such as for bulletproof hosting or naughty ASN.

4 - Where possible, yes. But some vendors are weirdly restrictive in their wildcard support. They are usually provided by external reports.

3
  1. Firewalls, DNS, EDR/XDR, Email Security Appliances
  2. I think the current domain count is somewhere in the 500,000 range. It probably could be bigger but I get enough requests for domain allowlisting that I try to keep it down to only the known bad domains or domains where I have some policy I can hit someone with if they complain.
  3. No. I don’t trust any of my tools to do their job adequately at the best of times, so if they overlap a bit and the EDR catches something that the firewall missed (or vice versa) then all the better.
  4. If I can safely do so then yes I will. If the initial attack vector was from a domain hijack, or a hacked wordpress blog or something then I will block just the FQDN.
4

How are you all evaluating the quality of these lists? I am so hesitant to implement automatic blocking because the potential business impact and my experience with the “free” feeds like Feodo/malware bazaar and the like are in my experience pretty bad.

5

We have a blog post coming out about this, but I do think there are better/worse OSINT feeds.

I haven’t had the same experience with MB/Abuse.ch, but AlienVault for sure. This list of OSINT feeds might be worth grading.

6

Some free lists are better than others. In some cases you have to read between the lines a bit to figure out what the intention for the list is supposed to be.

For example, a blocklist you find on Reddit for some dude’s homelab PiHole is going to likely be largely concerned with some basic privacy, ad blocking, and maybe stopping their kids from playing roblox or something.

Something you pull from Emerging Threats is going to be pretty good, but the intention is right in the name. So the list is likely going to change frequently, and may not be very triaged.

The vendor feeds that are pushed to your NGFW are going to be much more triaged, but they sacrifice speed for ensuring that validity (and even then, they sometimes fuck it up).

IMO, when it comes to a blocklist you have to ask yourself what you are looking for. Are you willing to have a list that is a month or two out of date to ensure the entries in it are verified malicious? Or do you want the hottest latest?

Personally, I like to tier the data into a couple of categories:

  • Known bad actors (or highly abused services) that aren’t going to change often. This is your bulletproof hosting providers, CDN’s hosted in countries you would normally have no reason to connect to, known abused proxy services like ngrok, tor exit nodes, etc
  • Verified bad. Largely I just leave this to whatever vendor-provided policies I’ve set.
  • Popular-New. Includes IOCs from whatever the popular attack method is these days, this is the one I spend the most amount of time on, mostly because it’s just me getting a sense of what’s changing in the landscape and pulling in IOCs manually from that
  • Popular-proven. This list is mostly the popular-new list but with the domains pulled out that are either false-positives, or someone has complained to me that it’s blocking something unintended.
  • The hottest-latest. I largely leave this to people far more skilled than me and just pull feeds from them. I would like to make my own one day though. I’m still learning how to do that exactly.

Each tier gets an increasing number of computers with most of the org sitting at the “Popular-Proven” tier.