Listen to this Post
Introduction:
Threat intelligence is no longer a luxury but a core pillar of modern Security Operations Centers (SOCs), enabling teams to shift from reactive alert-triage to proactive hunting and prevention. ANY.RUN, an interactive malware analysis sandbox trusted by over 15,000 SOCs, delivers real-time, actionable indicators of compromise (IOCs) and behavioral insights that accelerate incident response and reduce business risk. This article explores how to integrate ANY.RUN’s threat intelligence feeds into your SOC workflows, complete with hands-on commands, API configurations, and hardening techniques for both Linux and Windows environments.
Learning Objectives:
- Integrate ANY.RUN threat intelligence feeds via API to automate IOC ingestion into SIEM and EDR platforms.
- Deploy Linux and Windows commands to parse, validate, and act on threat intelligence data for real-time blocking.
- Implement cloud hardening and vulnerability mitigation strategies using extracted IOCs and YARA rules.
You Should Know:
- Extracting IOCs from ANY.RUN and Deploying Linux-Based Blocking Rules
ANY.RUN provides task-based analysis reports with network indicators (IPs, domains), file hashes (MD5, SHA256), and host artifacts. To automate retrieval, use the ANY.RUN public API (requires API key). Below is a step-by-step guide to fetch recent malicious indicators and apply them to Linux iptables for immediate network blocking.
Step-by-step guide:
- Obtain your API key from ANY.RUN “Settings” → “API”.
- Use `curl` to retrieve IOCs from recent public tasks (example endpoint: `https://any.run/api/v1/tasks/search?limit=10&status=completed`).
- Parse JSON output with `jq` to extract malicious IPs and domains.
- Append blocking rules to iptables and
/etc/hosts.
Commands:
bash
Fetch recent tasks (requires API key)
API_KEY=”your_api_key_here”
curl -s -H “Authorization: API-Key $API_KEY” “https://any.run/api/v1/tasks/search?limit=5” | jq -r ‘.data[].task.iocs | select(. != null) | .ip[]? , .domain[]?’ > malicious_ips_domains.txt
Deduplicate and block IPs with iptables
sort -u malicious_ips_domains.txt | while read line; do
if [[ $line =~ ^[0-9]+.[0-9]+.[0-9]+.[0-9]+$ ]]; then
sudo iptables -A INPUT -s $line -j DROP
sudo iptables -A OUTPUT -d $line -j DROP
echo “Blocked IP: $line”
else
echo “0.0.0.0 $line” | sudo tee -a /etc/hosts
fi
done
[/bash]
This script prevents any outbound or inbound communication with known malicious infrastructure, reducing the risk of command-and-control callbacks.
- Windows PowerShell Automation for Threat Intelligence Feed Integration
Windows SOC teams can integrate ANY.RUN IOC feeds into Windows Defender Firewall and local host files. The following PowerShell script retrieves fresh IOCs, converts them to firewall rules, and logs blocked attempts.
Step-by-step guide:
- Run PowerShell as Administrator.
- Invoke the ANY.RUN API using
Invoke-RestMethod. - Parse JSON to extract malicious IPs and domains.
- Create new inbound/outbound firewall rules for each IP.
- Append domain blocks to
C:\Windows\System32\drivers\etc\hosts.
PowerShell example:
bash
$APIKey = “your_api_key_here”
$Headers = @{ Authorization = “API-Key $APIKey” }
$Response = Invoke-RestMethod -Uri “https://any.run/api/v1/tasks/search?limit=10” -Headers $Headers
$Ips = $Response.data.task.iocs.ip -ne $null | Select-Object -Unique
$Domains = $Response.data.task.iocs.domain -ne $null | Select-Object -Unique
foreach ($ip in $Ips) {
New-NetFirewallRule -DisplayName “ANY.RUN Block $ip” -Direction Outbound -RemoteAddress $ip -Action Block
New-NetFirewallRule -DisplayName “ANY.RUN Block $ip Inbound” -Direction Inbound -RemoteAddress $ip -Action Block
}
foreach ($dom in $Domains) {
Add-Content -Path “$env:windir\System32\drivers\etc\hosts” -Value “0.0.0.0 $dom”
}
Write-Host “Blocked $($Ips.Count) IPs and $($Domains.Count) domains from ANY.RUN intel.”
[/bash]
This approach hardens Windows endpoints without requiring third-party agents.
3. API Security: Protecting Your Threat Intelligence Pipeline
When integrating ANY.RUN or any CTI feed, securing the API keys and the transport channel is vital. Attackers often target exposed automation scripts. Below are API security hardening steps for both Linux and Windows.
Step-by-step guide:
- Store API keys in environment variables or a secrets manager (e.g., HashiCorp Vault, Azure Key Vault) – never hardcode.
- Implement API request signing and rate limiting.
- Use TLS 1.3 for all outbound API calls.
- Rotate API keys every 30–60 days.
Linux security commands:
bash
Store key in environment variable (add to ~/.bashrc)
export ANYRUN_API_KEY=”your_key”
Use it in scripts without exposing
curl -H “Authorization: API-Key $ANYRUN_API_KEY” https://any.run/api/v1/user
Rotate key via API (if supported)
curl -X POST -H “Authorization: API-Key $OLD_KEY” https://any.run/api/v1/user/rotate_key
[/bash]
Windows environment variable (PowerShell):
bash
$env:ANYRUN_API_KEY = “your_key”
Invoke-RestMethod -Headers @{Authorization = “API-Key $env:ANYRUN_API_KEY”} -Uri “https://any.run/api/v1/user”
[/bash]
Additionally, audit API logs for anomalous access patterns using `auditd` on Linux or `Get-WinEvent` on Windows.
- Cloud Hardening with ANY.RUN Intel – AWS GuardDuty Custom Rules
Cloud environments require dynamic threat intelligence. Use ANY.RUN’s IP and domain feeds to create custom AWS GuardDuty threat lists or update AWS WAF rules automatically via Lambda.
Step-by-step guide:
- Deploy an AWS Lambda function (Python 3.9+) that fetches ANY.RUN IOCs every hour.
- Parse the JSON and upload a new threat list to S3 in plaintext (one IOC per line).
- Configure GuardDuty to reference that S3 bucket as a custom threat list.
- Alternatively, update AWS WAF IP sets using
boto3.
Lambda Python snippet:
bash
import boto3, requests, json
def lambda_handler(event, context):
api_key = os.environ[‘ANYRUN_API_KEY’]
headers = {‘Authorization’: f’API-Key {api_key}’}
resp = requests.get(‘https://any.run/api/v1/tasks/search?limit=50’, headers=headers)
iocs = set()
for task in resp.json()[‘data’]:
iocs.update(task[‘task’][‘iocs’].get(‘ip’, []))
Upload to S3
s3 = boto3.client(‘s3′)
s3.put_object(Bucket=’my-threat-list-bucket’, Key=’anyrun_iocs.txt’, Body=’\n’.join(iocs))
Update WAF IP set
waf = boto3.client(‘wafv2′)
waf.update_ip_set(Name=’MaliciousIPs’, Scope=’REGIONAL’, Addresses=[f'{ip}/32′ for ip in iocs], …)
[/bash]
This automation ensures cloud-native controls block newly discovered malicious IPs within minutes.
- Vulnerability Exploitation and Mitigation Using YARA Rules from ANY.RUN
ANY.RUN often generates YARA rules from analyzed malware samples. Integrate these rules into your endpoint detection strategy (e.g., using `yara` CLI or Velociraptor). Here’s how to test and deploy custom YARA rules on Linux and Windows.
Step-by-step guide:
- Download the YARA rule from ANY.RUN task “Indicators” → “YARA”.
- Test the rule against suspicious files or process memory.
- Deploy via cron job or Scheduled Task to scan critical directories.
- On Linux, use `yara` command-line tool; on Windows, use `yara64.exe` with PowerShell.
Linux scanning command:
bash
Install yara
sudo apt install yara -y
Download a YARA rule (example: ransomware detection)
curl -O https://any.run/api/v1/tasks/
Scan /tmp for matches
yara -r ransomware_rule.yar /tmp
[/bash]
Windows PowerShell:
bash
.\yara64.exe -r C:\path\to\rule.yar C:\suspicious\folder
Scheduled task to scan every hour
$Action = New-ScheduledTaskAction -Execute ‘C:\Tools\yara64.exe’ -Argument ‘-r rule.yar C:\Users\Public’
$Trigger = New-ScheduledTaskTrigger -Hourly -At 0
Register-ScheduledTask -TaskName “YARA_Scan” -Action $Action -Trigger $Trigger
[/bash]
Mitigation: If a file matches, quarantine it automatically using `move-item` on Windows or `mv` on Linux, and alert your SIEM.
- SOC Workflow Automation: Integrating ANY.RUN with TheHive and MISP
For mature SOCs, push ANY.RUN IOCs directly into open-source platforms like TheHive (case management) and MISP (threat sharing). Use webhooks or the ANY.RUN “Integrations” page.
Step-by-step guide:
- Configure ANY.RUN to send webhook notifications on task completion to a custom endpoint (e.g., a Python Flask server).
- Parse incoming JSON and create a case in TheHive via its REST API.
- Add observables (IP, hash, domain) automatically.
- Optionally, export observables to MISP for community sharing.
Python webhook example (Flask):
bash
from flask import Flask, request
import requests
app = Flask(name)
@app.route(‘/webhook/anyrun’, methods=[‘POST’])
def handle_anyrun():
data = request.json
iocs = data.get(‘task’, {}).get(‘iocs’, {})
thehive_url = “https://your-thehive/api/v1/case”
headers = {“Authorization”: “Bearer THEHIVE_API_KEY”}
case = {“title”: f”ANY.RUN: {data[‘task’][‘name’]}”, “description”: “Auto-created from ANY.RUN intel”, “observables”: []}
for ip in iocs.get(‘ip’, []):
case[‘observables’].append({“dataType”: “ip”, “data”: ip})
requests.post(thehive_url, json=case, headers=headers)
return “OK”, 200
[/bash]
This reduces manual triage time by 70%, as indicated by SOC analysts using ANY.RUN.
What Undercode Say:
- Key Takeaway 1: Automating threat intelligence ingestion from ANY.RUN using native OS commands (iptables, PowerShell, YARA) drastically reduces mean time to response (MTTR) without costly commercial SOAR tools.
- Key Takeaway 2: API security hygiene – environment variables, key rotation, and TLS – is non-negotiable; a leaked API key can expose your entire defense pipeline to adversaries.
Analysis: The integration of interactive sandbox outputs into defensive controls bridges the gap between malware analysis and active mitigation. ANY.RUN’s real-time IOCs, when combined with scripts that update firewalls, WAF rules, and YARA scanners, enable small SOC teams to operate with the agility of large enterprises. However, false positives remain a risk – always validate with a second intelligence source or a sandbox re-analysis before mass blocking critical assets. The commands provided give defenders immediate, actionable power, but they should be tested in a staging environment first.
Prediction:
By 2027, SOCs will standardize on “intelligence-driven automation loops” where every malware analysis sandbox (like ANY.RUN) instantly pushes IOCs into network and endpoint controls without human review for low-risk indicators. This will shrink the window of exposure from hours to seconds, forcing attackers to adopt polymorphic infrastructure that changes faster than automated updates. As a result, we will see a rise in AI-generated, ephemeral C2 domains and a corresponding need for machine-speed threat intelligence curation. SOC analysts will pivot from blocking known IOCs to hunting behavioral anomalies, with platforms like ANY.RUN evolving to provide pre-built automation workflows as a service. The line between analysis and response will blur entirely.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Integrate Threat – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
