shodan-threat-intel

Shodan Threat Intelligence Skill

Leverage Shodan for threat intelligence gathering, tracking malicious infrastructure, and identifying emerging threats.

When to Use

• Tracking command and control (C2) infrastructure
• Identifying malicious server patterns
• Monitoring for specific threat actor TTPs
• Investigating security incidents
• Proactive threat hunting
• IOC enrichment

Workflow

1. Intelligence Requirements

   • Define intelligence objectives
   • Identify indicators of compromise (IOCs)
   • Determine threat actor TTPs to track

2. Infrastructure Discovery

   • Search for C2 server characteristics
   • Identify phishing infrastructure
   • Find malware distribution points
   • Locate cryptocurrency mining operations

3. Pattern Analysis

   • Analyze service configurations
   • Identify unique banners or certificates
   • Track infrastructure changes over time
   • Correlate multiple indicators

4. Attribution Clues

   • SSL certificate patterns
   • Unique server configurations
   • Hosting provider patterns
   • Geographic clustering

5. Monitoring and Alerting

   • Set up regular queries for new threats
   • Track changes to known infrastructure
   • Monitor for copycat infrastructure

6. Intelligence Reporting

   • Document findings with context
   • Provide actionable intelligence
   • Share IOCs in standard formats

Threat Intelligence Queries

C2 Infrastructure

Cobalt Strike

product:"Cobalt Strike"
ssl:"Cobalt Strike"
http.html:"Cobalt Strike"

Metasploit

"metasploit" port:4444
ssl.cert.subject.cn:"MetasploitSelfSignedCA"

Generic C2 Beacons

http.html:"beacon"
port:8443,8080,443 ssl.cert.subject.cn:"localhost"

Phishing Infrastructure

http.title:"Microsoft" -org:"Microsoft"
http.title:"Login" ssl.cert.expired:true
http.title:"Amazon" -asn:AS16509

Ransomware Infrastructure

http.html:"your files have been encrypted"
http.title:"ransom"
"onion" http.html:"bitcoin"