ThreatFox Malware Domains

# ThreatFox Malware Domains

#### Source: ThreatFox
#### Feed information: https://threatfox.abuse.ch/faq/#tos
#### Feed link: https://threatfox.abuse.ch/downloads/hostfile/

## Defender XDR
```
let ThreatIntelFeed = externaldata(LineInfo: string)[@"https://threatfox.abuse.ch/downloads/hostfile/"] with (format="txt", ignoreFirstRecord=True);
let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
let MalwareDomains = materialize (
     ThreatIntelFeed
     | where LineInfo matches regex IPRegex
     | extend domain = extract(@'127.0.0.1(.*)\b', 1 , LineInfo)
     | distinct domain
     );
DeviceNetworkEvents
| where RemoteUrl has_any (MalwareDomains)
| project Timestamp, RemoteUrl, RemoteIP, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountDomain, InitiatingProcessAccountName
```


## Sentinel
```
let ThreatIntelFeed = externaldata(LineInfo: string)[@"https://threatfox.abuse.ch/downloads/hostfile/"] with (format="txt", ignoreFirstRecord=True);
let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
let MalwareDomains = materialize (
     ThreatIntelFeed
     | where LineInfo matches regex IPRegex
     | extend domain = extract(@'127.0.0.1(.*)\b', 1 , LineInfo)
     | distinct domain
     );
DeviceNetworkEvents
| where RemoteUrl has_any (MalwareDomains)
| project TimeGenerated, RemoteUrl, RemoteIP, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountDomain, InitiatingProcessAccountName
```