ANY.RUN adds Related Threat Context beside sandbox IOCs
Original title: Related Threat Context: Cut Time-to-Triage with Actionable Context for Every IOC
Enterprise analysts see industry, team, and threat-intelligence links next to sandbox indicators instead of searching manually.
ANY.RUN released Related Threat Context for Enterprise clients so SOC and MSSP analysts can view related context next to indicators found in Interactive Sandbox sessions. Matches can come from anonymized industry analyses, earlier team investigations, or ANY.RUN Threat Intelligence, with a path into Threat Intelligence Lookup. In a Kali365 example, related scans exposed extra malicious domains that were absent from the original analysis. Industry context is a signal rather than proof of targeting and is unavailable to MSSPs.
- Industry context is anonymized and is not offered to MSSP customers.
- Team context ties indicators to previous sandbox work by the same organization.
- Only register[.]rsvpconnect-events[.]com appeared in the sample Kali365 sandbox scan.
- A follow-up lookup linked ydgjgdbhoa[.]shifts[.]icu to Kali365-related activity.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | register.rsvpconnect-events.com | isible in the original sandbox analysis. In this case, only register[.]rsvpconnect-events[.]com appeared in the original scan. The other domains were n |
| domain | ydgjgdbhoa.shifts.ic | ciated with Kali365-related activity. View in TI Lookup The ydgjgdbhoa[.]shifts[.]ic u domain search results in TI Lookup By following these |
| domain | ydgjgdbhoa.shifts.icu | didates for further investigation. For example, let’s check ydgjgdbhoa[.]shifts[.]icu in TI Lookup. The search shows that the domain is assoc |
From the original article
9 min read at any.run
During triage, analysts may overlook valuable threat intelligence simply because they don’t know it exists. Previous investigations, related malicious activity, and industry-specific observations could provide the context needed to decide what to investigate next. With Related Threat Context, now available to ANY.
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.