Infections Detection Data feed

This documentation is intended for the use of Bitsight customers and partners only for the purposes of the agreement under which the document is submitted, and no part of it may be used, reproduced, modified or transmitted in any form or means without the prior written permission of Bitsight.

The documentation has been prepared to be used by professional personnel, and the customer assumes full responsibility when using it.

The information or statements given in this documentation concerning the suitability, capacity, or performance of the mentioned hardware or software products are given “as is” and all liability arising in connection with such hardware or software products shall be defined conclusively and finally in a separate agreement between Bitsight and the customer. Bitsight has made all reasonable efforts to ensure that the instructions contained in the document are adequate and free of material errors and omissions.

Bitsight will explain, if necessary, issues that may not be covered by the document.

Bitsight welcomes customer comments as part of the process of continuous development and improvement of the documentation.

Bitsight will correct errors in this documentation as soon as possible.

IN NO EVENT WILL BITSIGHT BE LIABLE FOR ERRORS IN THIS DOCUMENTATION OR FOR ANY DAMAGES, INCLUDING BUT NOT LIMITED TO SPECIAL, DIRECT, INDIRECT, INCIDENTAL OR CONSEQUENTIAL OR ANY LOSSES, SUCH AS BUT NOT LIMITED TO LOSS OF PROFIT, REVENUE, BUSINESS INTERRUPTION, BUSINESS OPPORTUNITY OR DATA,THAT MAY ARISE FROM THE USE OF THIS DOCUMENT OR THE INFORMATION IN IT.

This documentation and the product it describes are considered protected by copyrights and other intellectual property rights according to the applicable laws.

Bitsight brand and logo are trademarks of Bitsight.

Other product names mentioned in this document may be trademarks of their respective owners, and they are mentioned for identification purposes only.

Copyright © Bitsight 2019. All rights reserved.

Table of Contents

• About this document
• 1. Audience
• 2. Infections Detection API description
• 3. Structure
• 4. Fields Description

About this document

This document describes the Infection Detection threat intelligence Data feed.

This document is only distributed under a Non-Disclosure agreement between Bitsight and the reader.

1. Audience

This guide is destined to Authorized personnel within Bitsight’s customer.

Audience must possess adequate knowledge on Threat Intelligence, Datafeeds, JSON, Network security.

2. Infections Detection data feed description

The Infections Detection API allows users to:

1. Detect compromised machines from customer networks;
2. Prevent users from engaging in sensible transactions (e.g., banking operations) when they have been identified as having installed an information stealing Trojan;
3. Understand level of infection per malware family, on a company, network, local, country and worldwide;
4. Track botnet behavior, growth, dispersion and live time;
5. Aid in botnet takedown operations;

The feed served by the API contains metadata from real time communications between machines compromised with Trojans such as Zeus, Spyeye, XtremeRat, Conficker, etc., as seen when the given IP addresses try to request commands from their Command and Control centers operated by AnubisNetworks as sinkholes;

Visibility over sinkhole events, by looking at DNS traffic, thereby making it possible to detect potential compromises on scenarios where strict policy controls on a company blocks the C2 connection from actually reaching the C2s.

3. Structure

For the purpose of this document, each feed available on the Cyberfeed service is represented as a table, where dots (.) are used as a separator for the multi-level JSON structure and available attributes inside each event.

A JSON event such as: {"a":1,"b":{"c":"example”}}

Is therefore represented on a table using the following readable format:

Table 3-1 API example

4. Fields Description

Table 4-2 Infection Attributes