Passive Intelligence Gathering Analytics

### Overview In this talk, Chris Truncer (introduced also as Christopher Truncer), a red teamer at Mandiant and co-founder of the Veil Framework, introduces "Just Metadata"—an open-source framework developed in Python designed to passively gather and analyze intelligence on IP addresses and domain names. Truncer emphasizes that organizations often collect logs without analyzing them or inadvertently tip off attackers by scanning them actively or uploading targeted malware directly to public platforms like VirusTotal. Just Metadata aims to automate "blind intelligence gathering" and enrich metadata across large datasets using third-party open-source intelligence (OSINT) and threat intelligence feeds without touching or alerting target infrastructure.

### Key Topics - **Passive Intelligence Gathering vs. Active Reconnaissance**: Actively probing or uploading malware samples with internal strings to VirusTotal exposes detection and alerts adversaries. Passive collection enables investigators to gather context safely without target awareness. - **Limitations of Commercial Threat Intelligence**: While useful, traditional commercial threat intelligence feeds can be costly, generic, vulnerable to adversary subscription and evasion, and dependent on third-party analysis that lacks internal organizational context. - **OSINT Enrichment**: Open-source intelligence offers a low-cost alternative using public sources and APIs (such as Shodan, Whois, VirusTotal, and reputation lists), though the intelligence is fundamentally constrained by the reliability and fidelity of external providers. - **Design and Architecture of Just Metadata**: Built for speed, minimal setup, and modularity. The tool ingests flat files of IPs or domains, queries external sources via intelligence gathering modules, stores states in memory (with Python pickle save/import support), and runs analytical modules to uncover relationships.

### Technical Details - **Intel Gathering Modules**: Modular Python classes inheriting a standard structure with `__init__` and a `gather` method receiving a dictionary of IP objects. Data points collected include: - Network Whois data and geolocation (country, state, city, postal code, time zone, GPS coordinates). - Shodan data (open ports, service banners, banners, SSL certificates, SSH keys). - VirusTotal passive lookups (communicating samples, malicious/undetected sample counts, and malicious URLs without uploading malware files). - Public threat feeds (Tor exit nodes, Animus Project honeypot data, AlienVault reputation feeds, Malwarebytes). - Domain reputation through MyWOT. - **Analytical Modules**: Use an `analyze` method to evaluate attributes across stored IP objects: - `geo_info`: Aggregates top geographical metrics. - `port_search` and `top_ports`: Surfaces commonly exposed ports (e.g., port 7547, 80, 443, 22) across thousands of targets without sending packets. - `keys`: Identifies infrastructure relationships by correlating shared SSH host keys, shared HTTPS certificates, and certificate chains. - `virustotal`: Clusters IPs communicating with identical malicious sample hashes or hosting malware. - Data inspection tools: `ip_info` for detailed single-host dossiers and an `export` command that dumps all enriched fields into CSV format for external analysis.

### Takeaways - While Just Metadata does not perform definitive adversary attribution, it identifies critical technical overlaps (such as shared SSH keys or certificates across disparate netblocks) that indicate coordinated infrastructure. - The tool is useful for defenders examining suspicious web access logs or incident response callbacks, as well as red teamers conducting passive target reconnaissance. - Future planned enhancements highlighted by Truncer include passive DNS analysis, differential time comparisons between capture states, querying public GitHub repositories for SSH keys, and expanding data ingestion beyond IPs and domains to artifacts like MD5 file hashes.