Recently, Microsoft released an open source set of malicious file hash indicators identified as using COVID-19 themed malicious email attachments in attempted attacks against our customers. Office365 successfully blocked these attempts, but the indicators can be consumed and used by customers to further protect themselves. The feed of indicators is provided as data file on GitHub which can be consumed using MISP.
|In this blog post I will show Azure Sentinel customers how to set up a MISP server that can receive any public feeds, including these COVID-19 indicators, and import the data into your Azure Sentinel environment. It is also possible to use this code to import MISP data into Microsoft Defender ATP as well. Haim Goldshtein has already written a blog post on doing this. Instructions here have been tested on Ubuntu 18.04 but should be applicable to many other distributions – even WSL.
The COVID-specific threat intelligence feed represents a start at sharing some of Microsoft’s COVID-related IOCs. We will continue to explore ways to improve the data over the duration of the crisis. While some threats and actors are still best defended more discreetly, we are committed to greater transparency and taking community feedback on what types of information is most useful to defenders in protecting against COVID-related threats. This is a time limited feed. We are maintaining this feed through the peak of the outbreak to help organizations focus on recovery.
If you have questions or feedback on this COVID-19 feed, please email firstname.lastname@example.org.
To integrate this feed with your MISP server you will need to use the following URL:
The Docker project has already published comprehensive documentation on setting up the most recent version of Docker for your distribution of choice. For this blog I used the Ubuntu instructions.
The Docker MISP instance also requires ‘docker-compose’ so once you have followed the Docker install guide enter the following command.
sudo apt-get install docker-compose
Set up MISP Docker instance
The MISP project has published a Docker compose configuration, you can use this by first entering these commands.
git clone https://github.com/MISP/misp-docker
Next, you will need to edit the configuration file, making sure to set a strong password. If you do not set a strong enough password, you might not be able to sign into your MISP instance. This can be fixed later.
cp template.env .env
Now the Docker image needs to be built. Run these two commands to build the image and start the container.
sudo docker-compose build
sudo docker-compose up
At this point a MISP instance will be running on port 80. You should be able to sign in and begin adding new feeds. If you are hosting this server on the Internet, you will want to look at how to secure this installation further with TLS and restrictions on access to the web front end.
If you are unable to login to the front end, then perhaps the password was not strong enough. You can reset the password with the following commands.
sudo docker exec -i -t misp_web /bin/bash
/var/www/MISP/app/Console/cake Password email@example.com NEWPASSWORD
Add the COVID-19 feed
The next step is to add the Microsoft feed to the MISP server. There is good documentation for this but in brief click ‘Sync Actions’ on the main menu then ‘List feeds’ and click ‘Add Feed’. The address of Microsoft’s COVID-19 feed can be found above. Enter this in the URL textbox. Next you will need to select ‘Simple CSV Parsed Feed’ from the list box. Most of the text boxes can be left blank but you must set the ‘Value field(s) in the CSV’ to 2. Set the other properties to reasonable values and click Add. Make sure you have ticked the ‘Enable’ checkbox.
There are several other 3rd party feeds you may also want to enable and have available in your Sentinel workspace. Each of these will need to be enabled separately.
The next step is to ensure that the feed is automatically updated. In the ‘Scheduled Tasks’ section of the Administration menu set the fetch_feeds task frequency to 1h. If you want to fetch on a quicker schedule this can be performed via a cron job.
You should see a new COVID-19 event appear from the Microsoft COVID-19 feed when the sync process starts.
Retrieve your MISP auth key
Within the MISP web interface click ‘Event Actions’ on the menu bar then select ‘Automation’. Your MISP auth key will be listed on the screen, note this down for entry into the script later.
Connect your MISP instance to Sentinel
Much of this section is an abridged version of the Sentinel threat intelligence feed connector and MISP to Microsoft Graph script documentation. You should review this documentation first.
Create an App Registration with the required permissions
In order to connect your MISP server to Sentinel you need to create an App Registration with the required permissions. This is a straightforward process but does require a user with 'Global Administrator', 'Security Administrator' or 'Security Reader' permission to grant access. In brief:
- Open the Application Registration Portal and click New registration on the menu bar.
- Enter a name, and choose Register, other options can be left with their defaults.
- Note down the Application (client) ID and Directory (tenant) ID. You will need to enter these into the script’s configuration file.
- Under Certificates & secrets, click New client secret enter a description and click Add. A new secret will be displayed. Copy this for later entry into the script.
- Under API permissions, choose Add a permission > Microsoft Graph.
- Under Application Permissions, add ThreatIndicators.ReadWrite.OwnedBy.
Enable the Sentinel Connector
Open your Azure Sentinel workspace, click ‘Data connectors’ and then look for the ‘Threat Intelligence Platforms’ connection. Open the connector and click Connect.
Setup the script
The script can be run on any machine that has access to your MISP infrastructure and the Microsoft Graph API. In order to reduce complexity, I ran the script on the same machine as the MISP instance.
Enter the following commands. These will create an environment for the script to run, download it from GitHub, install the necessary prerequisites and open the configuration file.
sudo apt-get install python3-venv
python3 -m venv mispToSentinel
git clone https://github.com/microsoftgraph/security-api-solutions
pip install -r requirements.txt
There are a few options that need to be changed in the configuration file:
- Under the graph_auth key enter the details from the AAD App Registration earlier.
- Set the ‘<targetProduct>’ to be ‘Azure Sentinel’.
- I added a # comment at the start of each line in the misp_event_filters section to effectively disable any filtering, all data from the MISP server will be available in Sentinel.
- Set ‘<action>’ to ‘alert’.
- Enter you MISP auth key in ‘<misp key>’ and URL in ‘<misp url>’.
- Finally set the lifetime for this data, I would recommend 30-60 days depending on your use case.
You can now run the script to pull data from the MISP instance and push into your Sentinel workspace.
After a few minutes you should be able to query the ThreatIntelligenceIndicator table in your Sentinel workspace.
Use the data
Now the data is in your Sentinel workspace you can easily search for matching hashes in a variety of datasets. As an example, this query will examine the SecurityEvent table for matching hashes.
| summarize by FileHashValue;
| where FileHash in (BadHashes)