Flashpoint
Use the Flashpoint integration to access intelligence reports, technical data, and uniquely sourced conversations from illicit threat communities.
#
Configure Flashpoint on DemistoNavigate to Settings > Integrations > Servers & Services.
Search for Flashpoint.
Click Add instance to create and configure a new integration instance.
Parameter Description Example Name A meaningful name for the integration instance. Flashpoint_instance_1 URL The URL to the Flashpoint server, including the scheme. https://fp.tools API Key Your Flashpoint API key. N/A Trust any certificate (not secure) When selected, certificates are not checked. N/A Use system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. https://proxyserver.com Click Test to validate the new instance.
#
CommandsYou can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
#
Get the reputation of an IPReturns the reputation of an IP. The IP is considered malicious if there’s at least one IOC event in the Flashpoint database matching the IP indicator. The IP address is considered suspicious if it matches with any one of the torrent’s peer IP address or forum visit’s peer IP address.
#
Base Commandip
#
InputArgument Name | Description | Required |
---|---|---|
ip | The IP to check whether it is malicious or suspicious. | Optional |
Context Output
Path | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
IP.Address | string | The IP address. |
IP.Malicious.Description | string | The description of the malicious IP. |
IP.Malicious.Vendor | string | The vendor of the malicious IP. |
Flashpoint.IP.Event.Href | string | The list of the reference link of the indicator. |
Flashpoint.IP.Event.Address | string | The IP address of the indicator. |
Flashpoint.IP.Event.EventDetails | Unknown | The event details in which the indicator is observed. |
Flashpoint.IP.Event.Category | string | The category of the indicator. |
Flashpoint.IP.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.IP.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.IP.Event.Type | string | The type of the indicator. |
Flashpoint.IP.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.IP.Event.Comment | string | The comment which was provided when the indicator was observed. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint IP address reputation for 210.122.7.129Reputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Feb 12, 2018 21:46 | Lazarus Resurfaces, Targets Global Banks and Bitcoin Users | source:OSINT |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=ip-dst%2Cip-src&ioc_value=210.122.7.129
#
Get the reputation of a domainReturns the reputation of a domain. The domain is considered malicious if there’s at least one IOC event in the Flashpoint database matching the domain indicator.
#
Base Commanddomain
#
InputArgument Name | Description | Required |
---|---|---|
domain | The domain name to check. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
Flashpoint.Domain.Event.Href | string | A list of reference links for the indicator. |
Flashpoint.Domain.Event.Domain | string | The domain of the indicator. |
Flashpoint.Domain.Event.EventDetails | unknown | The event details in which the indicator is observed. |
Flashpoint.Domain.Event.Category | string | The category of the indicator. |
Flashpoint.Domain.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.Domain.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.Domain.Event.Type | string | The type of the indicator. |
Flashpoint.Domain.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.Domain.Event.Comment | string | The comment that was provided when the indicator was observed. |
Domain.Malicious.Description | string | The description of the malicious indicator. |
Domain.Malicious.Vendor | string | The vendor of the malicious indicator. |
Domain.Name | string | The name of the domain. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Domain reputation for subaat.comReputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Sep 25, 2019 19:51 | Gorgon Group actor profile | misp-galaxy:mitre-enterprise-attack-attack-pattern=“Spearphishing Attachment - T1193”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Scripting - T1064”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Command-Line Interface - T1059”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“System Information Discovery - T1082”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Remote Services - T1021”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Exfiltration Over Command and Control Channel - T1041”, os:Windows, source:phishing, type:RAT, malware🐀Quasar, malware:banker:Lokibot, filename: njrat.exe, file_name: excel.exe |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=domain&ioc_value=subaat.com
#
Get the reputation of the filenameReturns the reputation of the filename. The filename is considered malicious if there’s at least one IOC event in the Flashpoint database matching the filename indicator.
#
Base Commandfilename
#
InputArgument Name | Description | Required |
---|---|---|
filename | The filename to check. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
Flashpoint.Filename.Event.Href | string | A list of reference links for the indicator. |
Flashpoint.Filename.Event.Filename | string | The filename of the indicator. |
Flashpoint.Filename.Event.EventDetails | unknown | The event details in which the indicator is observed. |
Flashpoint.Filename.Event.Category | string | The category of the indicator. |
Flashpoint.Filename.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.Filename.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.Filename.Event.Type | string | The type of the indicator. |
Flashpoint.Filename.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.Filename.Event.Comment | string | The comment which was provided when the indicator was observed. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Filename reputation for .lockedReputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Oct 24, 2019 16:30 | LockerGoga | malware:ransomware:lockergoga, report:lKyimEX1TWS8x6AtdiJ_vA, report:jEteM4YxQZCdm4macbE3vQ, report:w0fL5MgoQ_Wih8XyB6Lowg, report:7t-BsuFKTL-HJWbid8nupg |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=filename&ioc_value=.locked
#
Get the reputation of the URLReturns the reputation of the URL. The URL is considered malicious if there’s at least one IOC event in the Flashpoint database matching the URL indicator.
#
Base Commandurl
#
InputArgument Name | Description | Required |
---|---|---|
url | The URL to check. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
Flashpoint.Url.Event.Href | string | A list of reference links for the indicator. |
Flashpoint.Url.Event.Url | string | The URL of the indicator. |
Flashpoint.Url.Event.EventDetails | unknown | The event details in which the indicator is observed. |
Flashpoint.Url.Event.Category | string | The category of the indicator. |
Flashpoint.Url.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.Url.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.Url.Event.Type | string | The type of the indicator. |
Flashpoint.Url.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.Url.Event.Comment | string | The comment which was provided when the indicator was observed. |
URL.Malicious.Description | string | The description of the malicious URL. |
URL.Malicious.Vendor | string | The vendor of the malicious URL. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint URL reputation for 92.63.197.153/krabaldento.exeReputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Oct 24, 2019 16:30 | GandCrab 2019 | malware:ransomware:GandCrab, report:lKyimEX1TWS8x6AtdiJ_vA, report:7t-BsuFKTL-HJWbid8nupg |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=url&ioc_value=92.63.197.153/krabaldento.exe
#
Get the reputation of the file-hashReturns the reputation of the file-hash. The file-hash is considered malicious if there’s at least one IOC event in the Flashpoint database matching the file-hash indicator.
#
Base Commandfile
#
InputArgument Name | Description | Required |
---|---|---|
file | A list of hashes of the file to query. Supports MD5, SHA1, and SHA256. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
Flashpoint.File.Event.Href | string | A list of reference links for the indicator. |
Flashpoint.File.Event.MD5 | string | The MD5 file hash of the indicator. |
Flashpoint.File.Event.SHA1 | string | The SHA1 file hash of the indicator. |
Flashpoint.File.Event.SHA256 | string | The SHA256 file hash of the indicator. |
Flashpoint.File.Event.EventDetails | unknown | The event details in which the indicator observed. |
Flashpoint.File.Event.Category | string | The category of the indicator. |
Flashpoint.File.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.File.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.File.Event.Type | string | The type of the indicator. |
Flashpoint.File.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.File.Event.Comment | string | The comment which was provided when the indicator was observed. |
File.Malicious.Description | string | The description of the malicious file. |
File.Malicious.Vendor | string | The vendor of the malicious file. |
File.MD5 | string | The MD5 hash of the file. |
File.SHA1 | string | The SHA1 hash of the file. |
File.SHA256 | string | The SHA256 hash of the file. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint File reputation for ab09761ad832efb9359fac985d1a2ab74f8a8d182d7b71188a121b850b80dfe5Reputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Dec 19, 2019 06:01 | Gandcrab | source:VirusTotal, type:Ransomware, gandcrab, malware:GandCrab, os:Windows |
Jul 17, 2019 18:02 | win_ransomware_generic | source:VirusTotal, type:Ransomware, win_ransomware_generic, os:Windows |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=md5%2Csha1%2Csha256%2Csha512&ioc_value=ab09761ad832efb9359fac985d1a2ab74f8a8d182d7b71188a121b850b80dfe5
#
Get the reputation of an EmailReturns the reputation of an email. The email is considered malicious if there’s at least one IOC event in Flashpoint database matching the email indicator.
#
Base Commandemail
#
InputArgument Name | Description | Required |
---|---|---|
The email to check. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
Flashpoint.Email.Event.Href | string | The list of the reference links of the indicator. |
Flashpoint.Email.Event.EventDetails | unknown | The event details in which the indicator is observed. |
Flashpoint.Email.Event.Category | string | The category of the indicator. |
Flashpoint.Email.Event.Fpid | string | The FPID of the indicator. |
Flashpoint.Email.Event.Timestamp | string | The time at which the indicator is observed. |
Flashpoint.Email.Event.Type | string | The type of the indicator. |
Flashpoint.Email.Event.Uuid | string | The UUID of the indicator. |
Flashpoint.Email.Event.Comment | string | The comment which was provided when the indicator was observed. |
Account.Email.Malicious.Description | string | The description of the malicious email account. |
Account.Email.Malicious.Vendor | string | The vendor of the malicious email. |
Account.Email.Name | string | The name of the indicator. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Email reputation for qicifomuejijika@o2.plReputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Oct 24, 2019 16:30 | LockerGoga | malware:ransomware:lockergoga, report:lKyimEX1TWS8x6AtdiJ_vA, report:jEteM4YxQZCdm4macbE3vQ, report:w0fL5MgoQ_Wih8XyB6Lowg, report:7t-BsuFKTL-HJWbid8nupg |
All events and details (fp-tools): https://fp.tools/home/search/iocs?group=indicator&ioc_type=email-dst%2Cemail-src%2Cemail-src-display-name%2Cemail-subject&ioc_value=qicifomuejijika%40o2.pl
#
Search for intelligence reportsReturns a list of intelligence reports based on a keyword or text.
#
Base Commandflashpoint-search-intelligence-reports
#
InputArgument Name | Description | Required |
---|---|---|
report_search | Search for a report using a keyword or text. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Report | Unknown | Display a list of reports based on a specified search query or keyword. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Intelligence reports related to search: isisTop 5 reports:
ISIS Media Rebuilds Following Sweeping Suspensions Summary: Despite Telegram?s aggressive and sustained targeting of jihadists on its platform, ISIS?s official media and supportive groups are beginning to rebuild on Telegram.
Telegram Targets ISIS Propaganda in Largest Platform Purge Summary: Between November 22 and 24, 2019, Telegram removed more than 7,000 jihadist channnels and bots from its platform?in the largest purge of ISIS propaganda in Telegram?s history. The takedown drastically impacted ISIS propaganda dissemination, knocking out critical channels and groups, many of which had operated uninterrupted for years.
Global Spotlight - Iran: Key Developments ThisWeek Summary: N/A
Dropbox Account Disseminates Far-Right Extremist Content Summary: Flashpoint analysts have identified a Dropbox account called ?NS Library? belonging to a far-right extremist containing over 200 white supremacist publications and guides?including neo-Nazi literature and propaganda, instruction manuals for making homemade weapons, survival guides, attackers? manifestos, and workout manuals, among other content.
ISIS Activity Continues Unabated Following al-Baghdadi’s Death Summary: On October 26, 2019, ISIS?s former leader Abu Bakr al-Baghdadi killed himself in the midst of a US military operation. Less than a week later, ISIS confirmed al-Baghdadi?s death, and announced that Abu Ibrahim al-Hashimi al-Qurashi is the group?s new leader. Link to Report-search on Flashpoint platform: https://fp.tools/home/search/reports?query=isis
#
Get a single reportReturns a single report by its ID.
#
Base Commandflashpoint-get-single-intelligence-report
#
InputArgument Name | Description | Required |
---|---|---|
report_id | Search report by report ID. The report ID can be known from the output context path Flashpoint.Report.ReportId of the report-search command or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Report.NotifiedAt | string | The notification date of the report. |
Flashpoint.Report.PlatformUrl | string | The platform URL of the report. It helps to redirect the Flashpoint platform. |
Flashpoint.Report.PostedAt | number | The posted date of the report. |
Flashpoint.Report.Summary | string | The summary of the report. |
Flashpoint.Report.Title | string | The title of the report. |
Flashpoint.Report.UpdatedAt | string | The last update date of the report. |
Flashpoint.Report.ReportId | string | The unique ID of the report. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Intelligence Report details#
Below are the details found:Title | Date Published (UTC) | Summary | Tags |
---|---|---|---|
ISIS Supporters Warn of the Risks Associated with Exif Data | Sep 23, 2019 20:27 | On September 17, 2019, multiple pro-ISIS Telegram groups disseminated a message warning of the dangers of exposed exif data?a type of metadata showing GPS coordinates, time, and date the image was taken and the make and model of the device used?that is typically captured from images taken by a phone or camera, unless the security settings are properly configured. | Intelligence Report, Law Enforcement & Military, Physical Threats, Jihadist, Propaganda, Terrorism, Global |
#
Get related reportsReturns related reports for a given report ID.
#
Base Commandflashpoint-get-related-reports
#
InputArgument Name | Description | Required |
---|---|---|
report_id | Search reports by the report ID. The report ID can be known from the output context path Flashpoint.Report.ReportId of report-search command or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Report | Unknown | Display a list of related reports based on the report FPID. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Intelligence related reports:Top 5 related reports:
Neo-Nazi Telegram Channel Incites Violence, Spreads Extremist Content Summary: In August 2019, militant white supremacist channel ?Stack the Bodies to God? appeared on Telegram, inciting violence and providing a large quantity of informational resources?including extremist publications, tactical manuals, survival guides, guerrilla warfare tactics, instructions for making homemade explosives, weapons, and ricin, and internet security tips.
Atomwaffen Division Resumes Recruitment Activity Summary: On September 30, 2019, the admin of ?The_Bowlcast? Telegram channel promoted the launch of the militant, white supremacist group ?Atomwaffen Division?s? (AWD) latest website and new video dubbed ?Nuclear Congress 2019,? which subtlely discusses the need for AWD to accomplish its goals?alluding to the need for new financing and recruitment.
“Vorherrschaft Division” (VSD): A Nascent Militant White Supremacy Group Summary: On June 14, 2019, a militant white supremacy group called ?Vorherrschaft Division? (VSD) announced its creation in its Telegram channel “Vorherrschaft division propaganda posting.”
“Boogaloo”: Accelerationists’ Latest Call to Action Summary: The term ?boogaloo? (also known as ?the boogaloo? and ?big igloo?) is the latest term used by accelerationists?advocates of hastening the collapse of society through violence?to describe an armed revolution against society to rebuild a white-ethno state.
Far-Right Prepares for “Meme War 2020” Summary: Members of the far-right community are preparing for what they call ?meme war 2020??content spread via social media focused on left-leaning targets?in the lead up to the 2020 U.S. presidential election. Link to the given Report on Flashpoint platform: https://fp.tools/home/intelligence/reports/report/tiPqg51OQpOTsoFyTaYa_w#detail
#
Get a single event's detailsReturns the details of a single event.
#
Base Commandflashpoint-get-single-event
#
InputArgument Name | Description | Required |
---|---|---|
event_id | The UUID or FPID that identifies a particular event. The event ID can be fetched from the output context path Flashpoint.Event.EventId get-events command or indicator reputation command response or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Event.ObservedTime | string | The date the event was triggered. |
Flashpoint.Event.EventCreatorEmail | string | The event creator of the email. |
Flashpoint.Event.Href | Unknown | Display the event reference. |
Flashpoint.Event.Tags | Unknown | Display the event tags. |
Flashpoint.Event.EventId | string | Display the event ID (event FPID). |
Flashpoint.Event.Name | string | The name of the event. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Event details#
Below are the detail found:Observed time (UTC) | Name | Tags |
---|---|---|
Jun 18, 2019 22:08 | CryptingService_4c0d570ecdf23529c91b8decf27107db5c5e9430_2019-06-17T03:01:03.000Z | source:CryptingService2 |
#
Get all event detailsReturns all the details of an event.
#
Base Commandflashpoint-get-events
#
InputArgument Name | Description | Required |
---|---|---|
time_period | Search events based on a specified time period. | Optional |
report_fpid | Search events by the report's FPID. A user can get a report's FPID from the output of the report-search or related-reports commands and use it in this command to get events for a specific Flashpoint report. | Optional |
limit | Specify the maximum number of records to display. | Optional |
attack_ids | Comma-separated values, attack_ids can be found in the event's information or on the Flashpoint platform using filtering events by attack IDs. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Event | Unknown | Display a list of multiple events. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Events#
Below are the detail found:Observed time (UTC) | Name | Tags |
---|---|---|
Dec 11, 2019 10:16 | CryptingService_4273f08ae5f229f6301e7e0cc9e9005cebc4da20_2019-12-11T03:01:01.000Z | source:CryptingService2 |
Dec 11, 2019 09:00 | NetWire | source:VirusTotal, T1060, netwire, T1056, os:Windows, type:RAT, malware:NetWire, T1082, T1116, T1113, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Registry Run Keys / Start Folder - T1060”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Input Capture - T1056”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“System Information Discovery - T1082”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Code Signing - T1116”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Screen Capture - T1113” |
Dec 11, 2019 08:00 | CyberGate | source:VirusTotal, os:Windows, type:RAT, cybergate, malware:CyberGate |
Dec 11, 2019 07:04 | ROKRAT_Nov17_1 | source:VirusTotal, T1057, T1105, T1063, os:Windows, target:SouthKorea, T1003, T1012, T1082, rokrat_nov17_1, malware:Rokrat, T1071, exfil:C2, T1102, T1041, T1056, type:RAT, T1497, T1113, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Process Discovery - T1057”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Remote File Copy - T1105”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Security Software Discovery - T1063”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Credential Dumping - T1003”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Query Registry - T1012”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“System Information Discovery - T1082”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Standard Application Layer Protocol - T1071”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Web Service - T1102”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Exfiltration Over Command and Control Channel - T1041”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Input Capture - T1056”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Screen Capture - T1113” |
Dec 11, 2019 07:04 | Sodinokibi_Unreachable_After_MZ_Check | source:VirusTotal, sodinokibi_unreachable_after_mz_check |
Dec 11, 2019 07:04 | MegaCortex_Load_Dinkum_CLib | source:VirusTotal, megacortex_load_dinkum_clib, malware:MegaCortex, type:Ransomware, os:Windows |
Dec 11, 2019 07:04 | Command_Line_Options | source:VirusTotal, command_line_options |
Dec 11, 2019 06:17 | CryptingService_74dd32ce57900738cba4d945e4619289ff040a9e_2019-12-11T03:01:01.000Z | source:CryptingService2 |
Dec 11, 2019 06:03 | Gandcrab | source:VirusTotal, type:Ransomware, gandcrab, malware:GandCrab, os:Windows |
Dec 11, 2019 06:00 | botox_lampeduza_amaterasu_output5E0600 | source:VirusTotal, botox_lampeduza_amaterasu_output5e0600 |
Dec 11, 2019 04:17 | CryptingService_e2f163c72837c6b4386ef9158d017418ab149b13_2019-12-11T03:01:01.000Z | source:CryptingService2 |
Dec 11, 2019 04:16 | CryptingService_2c13004c346bf79bbec61f6a65fb5b11d5c6f557_2019-12-11T02:01:02.000Z | source:CryptingService2 |
Dec 11, 2019 04:16 | CryptingService_5eda60cd7c1d4e5dd4fc5e0d3746bd4879de3959_2019-12-11T03:01:01.000Z | source:CryptingService2 |
Dec 11, 2019 04:16 | CryptingService_981ad08f56f265e9e7209e09e3842d8a6b7f7563_2019-12-11T03:01:01.000Z | source:CryptingService2 |
Dec 11, 2019 04:16 | CryptingService_7dbfe923559cbb91031dbe2b616c16f5aa40233f_2019-12-11T02:01:02.000Z | source:CryptingService2 |
Dec 11, 2019 04:00 | cobalt_beacon | source:VirusTotal, cobalt_beacon |
Dec 10, 2019 19:00 | Loki | source:VirusTotal, type:Stealer, malware:Loki, loki, os:Windows |
Dec 10, 2019 19:00 | crime_alina_pos_3 | source:VirusTotal, crime_alina_pos_3, type:POS, malware:Alina |
Dec 10, 2019 19:00 | Kovter | source:VirusTotal, actor:KovCoreG, kovter, os:Windows, type:Trojan, malware:Kovter |
Dec 10, 2019 17:24 | zeroclear Oilrig | origin:Iran, actor:APT34, malware:ransomware:zeroclear |
All events and details (fp-tools): https://fp.tools/home/search/iocs
#
Get any type of indicatorReturns any type of indicator by searching common terms.
#
Base Commandflashpoint-common-lookup
#
InputArgument Name | Description | Required |
---|---|---|
indicator | Specify the indicator value such as domain, IP, email, URL etc. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
DBotScore.Indicator | string | The indicator that was tested. |
DBotScore.Score | number | The indicator score. |
DBotScore.Type | string | The indicator type. |
DBotScore.Vendor | string | The vendor used to calculate the score. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint reputation for mondns.myftp.bizReputation: Malicious
#
Events in which this IOC observedDate Observed (UTC) | Name | Tags |
---|---|---|
Oct 11, 2019 15:30 | ModiRAT | misp-galaxy:mitre-enterprise-attack-attack-pattern=“Deobfuscate/Decode Files or Information - T1140”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“System Owner/User Discovery - T1033”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“System Information Discovery - T1082”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Screen Capture - T1113”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Custom Command and Control Protocol - T1094”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Data Encoding - T1132”, misp-galaxy:mitre-enterprise-attack-attack-pattern=“Uncommonly Used Port - T1065”, malware:ModiRAT, type:RAT, os:Windows, report:FQmMHh1rR_WuGd_PNVv-bQ |
#
Get forum detailsReturns the details of the forum.
#
Base Commandflashpoint-get-forum-details
#
InputArgument Name | Description | Required |
---|---|---|
forum_id | Specifies the forum ID for which the details are to be fetched. The forum ID can be known from the context path Flashpoint.Forum.ForumId or Flashpoint.Forum.Post.Forum.id of flashpoint-search-forum-posts command or some other investigation. | Required |
Context Output#
Path | Type | Description |
---|---|---|
Flashpoint.Forum.Description | string | The detailed information of the supplied forum ID. |
Flashpoint.Forum.Hostname | string | The host details of the supplied forum ID. |
Flashpoint.Forum.Name | string | The name of the forum. |
Flashpoint.Forum.Stats | Unknown | The displayed statistical information such as the number of posts, rooms, threads and users details. |
Flashpoint.Forum.Tags | Unknown | The displayed list of tags which include ID, name, parent_tag, and UUID. |
Flashpoint.Forum.ForumId | string | The forum’s unique ID. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Forum details#
Below are the details found:Name | Hostname | Tags |
---|---|---|
0hack | bbs.0hack.com | Chinese, Cyber Threat, Hacking, Language |
#
Get the details of a roomReturns the details of a room.
#
Base Commandflashpoint-get-forum-room-details
#
InputArgument Name | Description | Required |
---|---|---|
room_id | Specify the room ID which is used to retrieve the room information in the forum. The room ID can be known from the context path Flashpoint.Forum.Post.Room.id of flashpoint-search-forum-posts command or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Forum.Room.Forum | Unknown | Display all forum details such as forum name, hostname, platform URL, stats and tags etc. |
Flashpoint.Forum.Room.Title | string | The room title. A user can use the same title in the forum search command. |
Flashpoint.Forum.Room.Url | string | The room's URL. |
Flashpoint.Forum.Room.RoomId | string | The unique ID of the forum room. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Room details#
Below are the detail found:Forum Name | Title | URL |
---|---|---|
Crdpro | Bank Carding | forumdisplay.php?f=70&s=6e25902255e1b57bfe37dd2749dafd66 |
#
Get the user's detailsGets details on the user.
#
Base Commandflashpoint-get-forum-user-details
#
InputArgument Name | Description | Required |
---|---|---|
user_id | Specify a user's ID which is used to retrieve the user’s information. The user ID can be known from the context path Flashpoint.Forum.Post.User.id of flashpoint-search-forum-posts command or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Forum.User.Forum | Unknown | Display all of the forum's details like ID, hostname, description, stats, tags etc. |
Flashpoint.Forum.User.Name | string | The name of the user. |
Flashpoint.Forum.User.PlatformUrl | string | The platform URL of the user which is redirected to the Flashpoint platform. |
Flashpoint.Forum.User.Url | string | The URL of the user. |
Flashpoint.Forum.User.UserId | string | Unique ID of a forum user. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint User details#
Below are the detail found:Forum Name | Name | URL |
---|---|---|
Crdpro | IllWillPub | http://www.crdpro.su/member.php?s=9f099a0eebc5f7c79e36fc688af2f697&u=50678 |
#
Get the details of a postReturns the details of a post.
#
Base Commandflashpoint-get-forum-post-details
#
InputArgument Name | Description | Required |
---|---|---|
post_id | Specify the post ID which gives post information embed in the forum, room, user etc. The post ID can be known from the context path Flashpoint.Forum.Post.PostId of flashpoint-search-forum-posts command or some other investigation. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Forum.Post.Forum | Unknown | Display all forum details of a post such as ID, hostname, stats, description, tags etc. |
Flashpoint.Forum.Post.Room | Unknown | Display the room details of a post such as room title, ID, URL, platform URL etc. |
Flashpoint.Forum.Post.User | Unknown | Display a user's details of a post such as a user's ID, name, URL, platform URL etc. |
Flashpoint.Forum.Post.PlatformUrl | string | The platform URL a user can redirect to the Flashpoint platform. |
Flashpoint.Forum.Post.PublishedAt | Unknown | The published date of the post. |
Flashpoint.Forum.Post.Url | Unknown | The URL display of the post. |
Flashpoint.Forum.Post.PostId | string | The unique ID of the forum post. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Post details#
Below are the detail found:Published at | Forum Name | Room Title | Author Name | Thread Title | URL | Platform url |
---|---|---|---|---|---|---|
2019-12-10T01:17:00+00:00 | Ord-UA | Форум | Дубовик | ДСНС на чолі з Бочковським і К…. | 2014/10/22/dsns-na-choli-z-bochkovskim-i-k/?lpage=1&page=580 | https://fp.tools/home/ddw/forums/threads/M3NorvmYVoG6rVFHnP3T9w?id=PDo1xGiKXDebHGc8fZme6g |
#
Search forum sitesSearches the forum sites using a keyword. The search will return in-site content such as name, title, description etc.
#
Base Commandflashpoint-search-forum-sites
#
InputArgument Name | Description | Required |
---|---|---|
site_search | Search by site keyword or text. This keyword is used for search information in forum sites. This keyword or text is known by fp user. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Forum.Site | Unknown | The list of forum site details based on the search keyword. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Forum sites related to search: 0hackTop 10 sites:
#
Below are the detail found:Name | Hostname | Description |
---|---|---|
0hack | bbs.0hack.com | 0hack (零黑联盟) is a Chinese-language hacker training forum. The forum appears to be affiliated with 非凡安全网, 803389.com. |
#
Search forum postsSearches the forum posts using a keyword.
#
Base Commandflashpoint-search-forum-posts
#
InputArgument Name | Description | Required |
---|---|---|
post_search | Search a post by keyword or text which is used for search information in forum posts. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Flashpoint.Forum.Post | Unknown | Display a list of forum posts based on the specified search keyword. |
#
Command Example#
Context Example#
Human Readable Output#
Flashpoint Forum posts related to search: The Courtyard CaféTop 10 posts:
#
Below are the detail found:Forum Name | Thread Title | Room Title | Author Name | Platform URL |
---|---|---|---|---|
The Sammyboy Times | Fleeting Pleasures… | The Courtyard Café | glockman | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | smoke on the water, fire in th… | The Courtyard Café | syed putra | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | [Singapore] - French girl kena… | The Courtyard Café | laksaboy | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | smoke on the water, fire in th… | The Courtyard Café | laksaboy | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | smoke on the water, fire in th… | The Courtyard Café | Leongsam | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | smoke on the water, fire in th… | The Courtyard Café | rambo22 | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | Fleeting Pleasures… | The Courtyard Café | nightsafari | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | [Singapore] - French girl kena… | The Courtyard Café | nightsafari | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | [Singapore] - French girl kena… | The Courtyard Café | nightsafari | https://fp.tools/home/ddw/foru… |
The Sammyboy Times | HTHT… | The Courtyard Café | Claire | https://fp.tools/home/ddw/foru… |
Follow this link to forum post-search on Flashpoint platform.