Anatomy of a Grey Noise Tag | Grey Noise Blog

Summary: GreyNoise explains how its tags work: rather than viewing data IP by IP, tags attribute IPs to specific behaviors or actors, with classifications split into Intent (Unknown, Malicious, Benign) and Category (Activity, Tool, Actor, Worm, Search Engine). The post walks through writing a Benign Actor tag for a crawler called dataproviderbot, whose rDNS-based tag stopped matching after the crawler changed its name, and a Malicious Activity tag built from a PCAP showing an HTTP GET to /device.rsp?opt=user&cmd=list with a uid=admin cookie, which a search matched to CVE-2018-9995.
What you should know: A tag that silently stops matching because an actor renamed its crawler is a detection gap you won't see in a dashboard, and the packet example shows how a single request line and cookie value can be the whole signature for an authentication bypass.

Read the original at GreyNoise Blog ↗