TweetFeed

Feeds of IOCs posted on Twitter

Web version at TweetFeed.live / Code at TweetFeed (code)

Content

Data collected
Some statistics
How it works
Hunting IOCs via Microsoft Defender
Author
Disclaimer

Give a Star! ⭐

If you like the project, please consider giving it a star!

Data collected

Feeds
2022-10-21 18:06:44 (UTC)
Today	Last 7 days	Last 30 days	Last 365 days
📋 Today (raw)	📋 Week (raw)	📋 Month (raw)	📋 Year (raw)

Output example

_{Date (UTC)}	_SourceUser	_Type	_Value	_Tags	_Tweet
_{2021-08-14 02:26:32}	_{phishunt_io}	_url	_{https://netflix.us2.cards/}	_{#phishing #scam}	_{https://twitter.com/phishunt_io/status/1426369619422502917}
_{2021-08-17 12:15:00}	_{TheDFIRReport}	_ip	_185.56.76.94	_#Trickbot	_{https://twitter.com/TheDFIRReport/status/1427604874053578756}

Some statistics

IOCs

IOC	Today	Week	Month	Year
🔗 URLs	432	4813	15426	148875
🌐 Domains	43	665	1804	28608
🚩 IPs	87	771	3512	60439
🔢 SHA256	10	78	372	24374
🔢 MD5	107	453	1391	4262

Tag	Today	Week	Month	Year
#phishing	402	3402	15016	183377
#scam	58	1068	3773	32811
#malware	213	2793	4180	22299
#maldoc	0	0	0	216
#ransomware	16	186	384	1012
#banker	0	0	1	32
#AgentTesla	0	6	55	3511
#Alienbot	0	0	0	11
#BazarLoader	0	0	0	189
#CobaltStrike	15	264	1248	21615
#Dridex	0	0	0	676
#Emotet	0	0	1	1614
#FluBot	0	0	0	17
#Follina	0	0	5	149
#Formbook	0	3	86	3498
#GootLoader	0	3	4	724
#GuLoader	0	2	17	252
#Hancitor	0	0	0	70
#IcedID	0	6	44	506
#Lazarus	2	6	20	171
#Lokibot	0	6	72	1204
#log4j	0	0	0	247
#Log4shell	0	0	0	231
#ProxyNotShell	0	1	2	2
#ProxyShell	0	0	1	35
#Qakbot	0	0	14	312
#Raccoon	0	0	28	907
#RedLine	3	16	44	3170
#Remcos	0	0	56	935
#Spring4Shell	0	0	0	26
#Trickbot	0	0	0	77
#Ursnif	0	0	15	362

Top reporters (today)

Number	User	IOCs
#1	ecarlesi	302
#2	RedPacketSec	102
#3	pingineer_jp	37
#4	KesaGataMe0	36
#5	quicksandphish	25
#6	harugasumi	19
#7	romonlyht	19
#8	drb_ra	15
#9	illegalFawn	15
#10	AP_Zenmashi	14

How it works?

Search tweets that contain certain tags or that are posted by certain infosec people.

Tags being searched

(not case sensitive)

- #phishing
- #scam
- #malware
- #maldoc
- #ransomware
- #banker
- #AgentTesla
- #Alienbot
- #BazarLoader
- #CobaltStrike
- #Dridex
- #Emotet
- #FluBot
- #Follina
- #Formbook
- #GootLoader
- #GuLoader
- #Hancitor
- #IcedID
- #Lazarus
- #Lokibot
- #log4j
- #Log4shell
- #ProxyNotShell
- #ProxyShell
- #Qakbot
- #Raccoon
- #RedLine
- #Remcos
- #Spring4Shell
- #Trickbot
- #Ursnif

Also search Tweets posted by

(these are trusted folks that sometimes don't use tags)

TweetFeed list

IOCs being collected

- URL
- Domain
- IP address
- SHA256 hash
- MD5 hash

Hunting IOCs via Microsoft Defender

1. Search SHA256 hashes with yearly tweets feed

let MaxAge = ago(30d);
let SHA256_whitelist = pack_array(
'XXX' // Some SHA256 hash you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'sha256'
    | extend SHA256 = tostring(report[3])
    | where SHA256 !in(SHA256_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project SHA256, Tag, Tweet 
);
union (
    TweetFeed
    | join (
        DeviceProcessEvents
        | where Timestamp > MaxAge
    ) on SHA256
), (
    TweetFeed
    | join (
        DeviceFileEvents
        | where Timestamp > MaxAge
    ) on SHA256
), ( 
    TweetFeed
    | join (
        DeviceImageLoadEvents
        | where Timestamp > MaxAge
    ) on SHA256
) | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Tag, Tweet

2. Search IP addresses with monthly tweets feed

let MaxAge = ago(30d);
let IPaddress_whitelist = pack_array(
'XXX' // Some IP address you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'ip'
    | extend RemoteIP = tostring(report[3])
    | where RemoteIP !in(IPaddress_whitelist)
    | where not(ipv4_is_private(RemoteIP))
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteIP, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteIP
) | project Timestamp, DeviceName, RemoteIP, Tag, Tweet

3. Search urls and domains with weekly tweets feed

let MaxAge = ago(30d);
let domain_whitelist = pack_array(
'XXX' // Some URL/Domain you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type in('url','domain')
    | extend RemoteUrl = tostring(report[3])
    | where RemoteUrl !in(domain_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteUrl, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteUrl
) | project Timestamp, DeviceName, RemoteUrl, Tag, Tweet

Author

Daniel López

Disclaimer

Please note that all the data is collected from Twitter and sorted/served here as it is on best effort.

I have tried to tune as much as possible the searches trying to collect only valuable info. However please consider making your own analysis before taking any action related to these IOCs.

Anyway feel free to reach me out regarding any False Positive or to provide any kind of feedback.

By the Community for the Community

Chudry/TweetFeed