Six Ways to Threat Hunt in Grey Noise

Summary: GreyNoise published six threat-hunting techniques built on its Query Language, including wildcard and boolean searches, ASN and organization lookups, JA3 TLS fingerprints, raw-request searches for encoded commands, and the GreyNoise CLI. The post notes that of the top 50 noisiest IPs scanning for exposed RDP, the group had covered almost every one of the 65,535 possible ports, and that 80% of the top 20 noisiest IPs returned one of two Windows banners on Shodan.
Why it matters: A single cluster of scanners touched nearly all 65,535 ports looking for exposed RDP, and most of the loudest hosts ran Windows versions tied to known vulnerabilities, several from the same provider - suggesting a default image that is not being updated.

Read the original at GreyNoise Blog ↗