🆕 How to Cut Triage Time When a Single IOC Reveals a Broader Campaign

🎉 Instead of manually rebuilding context around every IOC, your analysts can now immediately identify the behavioral pattern in #ANYRUN Sandbox and investigate the related activity in #ANYRUN Threat Intelligence in one connected workflow and turn findings into detection logic.

Take this sandbox analysis of a malicious .exe as an example: https://app.any.run/tasks/00279254-9992-486d-8de9-802553ed3d4b/?utm_source=mastodon&utm_medium=post&utm_campaign=related_threat_context_release&utm_content=linktoservice&utm_term=211026

1️⃣ Once the analysis is complete, open Related analyses in the top-right corner and explore all the IOCs. Select a malicious IP address found in the session.

2️⃣ A TI Lookup search shows related scans dating back to July, submitted from different sources but sharing similar network activity. Reviewing just a few of them reveals a recurring delivery chain: JavaScript ➡️ PowerShell ➡️ .NET payload

To go deeper, pivot to related IPs and domains to uncover additional IOCs, infrastructure, and detection opportunities beyond the original sample 🔍

✅ Now available to #ANYRUN Enterprise clients, Related Threat Context shows whether an IOC is a fresh signal or part of widespread activity, adding historical context and industry-related activity directly to Sandbox analysis to help analysts decide what to prioritize, investigate, or escalate.

⚡️ Bring relevant context into every investigation to speed up triage, reduce duplicate work, and lower MTTR. Learn more about Related Threat Context: https://any.run/cybersecurity-blog/related-threat-context-release/?utm_source=mastodon&utm_medium=post&utm_campaign=related_threat_context_release&utm_content=linktoblog&utm_term=211026

#cybersecurity #infosec