TweetFeed.live | Source code | Feedback

TweetFeed.live

☰ Content

❤️ Support the project

📄 Data collected

📊 Some statistics

❓ How it works?

Tags being searched

(not case sensitive)

- #phishing
- #scam
- #opendir
- #malware
- #maldoc
- #ransomware
- #banker
- #AgentTesla
- #Alienbot
- #AsyncRAT
- #BazarLoader
- #Batloader
- #CobaltStrike
- #Dcrat
- #Emotet
- #Formbook
- #GootLoader
- #GuLoader
- #IcedID
- #Lazarus
- #Lokibot
- #log4j
- #Log4shell
- #Njrat
- #Qakbot
- #Raccoon
- #RedLine
- #Remcos
- #RaspberryRobin
- #Spring4Shell
- #SocGholish
- #Ursnif

Also search Tweets posted by

(these are trusted folks that sometimes don't use tags)

🔍 Hunting IOCs via Microsoft Defender

let MaxAge = ago(30d);
let SHA256_whitelist = pack_array(
'XXX' // Some SHA256 hash you want to whitelist.
);
let TweetFeed = materialize (
 (externaldata(report:string)
 [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv"]
 with (format = "txt"))
 | extend report = parse_csv(report)
 | extend Type = tostring(report[2])
 | where Type == 'sha256'
 | extend SHA256 = tostring(report[3])
 | where SHA256 !in(SHA256_whitelist)
 | extend Tag = tostring(report[4])
 | extend Tweet = tostring(report[5])
 | project SHA256, Tag, Tweet 
);
union (
 TweetFeed
 | join (
 DeviceProcessEvents
 | where Timestamp > MaxAge
 ) on SHA256
), (
 TweetFeed
 | join (
 DeviceFileEvents
 | where Timestamp > MaxAge
 ) on SHA256
), ( 
 TweetFeed
 | join (
 DeviceImageLoadEvents
 | where Timestamp > MaxAge
 ) on SHA256
) | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Tag, Tweet

let MaxAge = ago(30d);
let IPaddress_whitelist = pack_array(
'XXX' // Some IP address you want to whitelist.
);
let TweetFeed = materialize (
 (externaldata(report:string)
 [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv"]
 with (format = "txt"))
 | extend report = parse_csv(report)
 | extend Type = tostring(report[2])
 | where Type == 'ip'
 | extend RemoteIP = tostring(report[3])
 | where RemoteIP !in(IPaddress_whitelist)
 | where not(ipv4_is_private(RemoteIP))
 | extend Tag = tostring(report[4])
 | extend Tweet = tostring(report[5])
 | project RemoteIP, Tag, Tweet 
);
union (
TweetFeed
 | join (
 DeviceNetworkEvents
 | where Timestamp > MaxAge
 ) on RemoteIP
) | project Timestamp, DeviceName, RemoteIP, Tag, Tweet

let MaxAge = ago(30d);
let domain_whitelist = pack_array(
'XXX' // Some URL/Domain you want to whitelist.
);
let TweetFeed = materialize (
 (externaldata(report:string)
 [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
 with (format = "txt"))
 | extend report = parse_csv(report)
 | extend Type = tostring(report[2])
 | where Type in('url','domain')
 | extend RemoteUrl = tostring(report[3])
 | where RemoteUrl !in(domain_whitelist)
 | extend Tag = tostring(report[4])
 | extend Tweet = tostring(report[5])
 | project RemoteUrl, Tag, Tweet 
);
union (
TweetFeed
 | join (
 DeviceNetworkEvents
 | where Timestamp > MaxAge
 ) on RemoteUrl
) | project Timestamp, DeviceName, RemoteUrl, Tag, Tweet

👤 Author

📌 Disclaimer