Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1081678" data-attributes="member: 99014">Just malware hashes, you must use an API such as bazaar or VT API.[URL unfurl=&quot;true&quot;]https://bazaar.abuse.ch/api/[/URL][URL unfurl=&quot;true&quot;]https://docs.virustotal.com/reference/overview[/URL][CODE] tip.kaspersky.com/Help/Doc_data/en-US/ThreatLookupAPI.htm [/CODE]Some of these APIs are not free, subscriptions are required as threat intelligence, specially when curated and properly checked for FPs is not free.Many AV vendors offer APIs as well.The Bazaar API should be free but it is plagued with false positives.You implement it via HTTP Post request like this:[CODE]wget --post-data &quot;query=get_info&amp;hash=7de2c1bf58bce09eecc70476747d88a26163c3d6bb1d85235c24a558d1f16754&quot; https://mb-api.abuse.ch/api/v1/[/CODE]In addition, the Sophos Sorel collection contains 20 million samples you can use to train ML models, be advised that you will also need a large number of safe files for false positives control.[URL unfurl=&quot;true&quot;]https://ai.sophos.com/2020/12/14/sophos-reversinglabs-sorel-20-million-sample-malware-dataset/[/URL]I also found this, that contains more APIs, supposedly open source.[URL unfurl=&quot;true&quot;]https://github.com/ashwin-patil/threat-hunting-with-notebooks/blob/master/Open%20Source%20Threat%20Intel%20lookup%20using%20Requests%20API.ipynb[/URL][URL unfurl=&quot;true&quot;]https://github.com/jaegeral/security-apis[/URL][URL unfurl=&quot;true&quot;]https://github.com/keithjjones/cuckoo-api[/URL]</blockquote>

[QUOTE="Trident, post: 1081678, member: 99014"] Just malware hashes, you must use an API such as bazaar or VT API. [URL unfurl="true"]https://bazaar.abuse.ch/api/[/URL] [URL unfurl="true"]https://docs.virustotal.com/reference/overview[/URL] [CODE] tip.kaspersky.com/Help/Doc_data/en-US/ThreatLookupAPI.htm [/CODE] Some of these APIs are not free, subscriptions are required as threat intelligence, specially when curated and properly checked for FPs is not free. Many AV vendors offer APIs as well. The Bazaar API should be free but it is plagued with false positives. You implement it via HTTP Post request like this: [CODE]wget --post-data "query=get_info&hash=7de2c1bf58bce09eecc70476747d88a26163c3d6bb1d85235c24a558d1f16754" https://mb-api.abuse.ch/api/v1/[/CODE] In addition, the Sophos Sorel collection contains 20 million samples you can use to train ML models, be advised that you will also need a large number of safe files for false positives control. [URL unfurl="true"]https://ai.sophos.com/2020/12/14/sophos-reversinglabs-sorel-20-million-sample-malware-dataset/[/URL] I also found this, that contains more APIs, supposedly open source. [URL unfurl="true"]https://github.com/ashwin-patil/threat-hunting-with-notebooks/blob/master/Open%20Source%20Threat%20Intel%20lookup%20using%20Requests%20API.ipynb[/URL] [URL unfurl="true"]https://github.com/jaegeral/security-apis[/URL] [URL unfurl="true"]https://github.com/keithjjones/cuckoo-api[/URL] [/QUOTE]

Verification