Censys launches module to boost proactive threat hunting ability

Censys has introduced a new module designed to enable security teams to proactively identify and mitigate targeted cyber threats using structured Internet intelligence data.

The Censys Threat Hunting module builds upon the company's Internet Intelligence platform by providing threat hunters with tools to track adversary infrastructure and accelerate the process of threat detection and investigation. This marks a shift from the traditional reactive approach of responding to alerts, towards actively seeking and neutralising threats before they cause harm.

According to Censys, the module integrates directly into existing security operations products, enhancing organisations' detection pipelines. The platform automatically processes raw Internet Map data into actionable insights, which can be used to pinpoint malicious infrastructure that may be employed to target their organisation.

Silas Cutler, Principal Security Researcher at Censys, was involved in developing the new module. He said: "One of the biggest pain points for us threat hunters is the inability to acquire timely and relevant data that enables them to proactively defend against targeted threats. The new Censys Threat Hunting module solves that challenge by delivering real-time visibility to existing malicious infrastructure and the ability to find, pivot, and track known and emerging threats targeting their organisation anywhere on the Internet."

The module is designed to reduce data overload by providing a centralised location for all threat hunting data. Security teams receive access to a list of known threats, along with a heat map visualising their geographic or network distribution. This functionality aims to assist teams in identifying and prioritising threats more effectively.

Among the features of the Censys Threat Hunting module is the Censys Threats Dataset, which includes detections for commonly used red team tools, malware operation fingerprints, and extended context around each threat. This context provides users with alternative names, known actors, and relevant reference links to aid in investigations.

Another capability, called CensEye, enables threat hunters to identify and correlate malicious infrastructure by recognising hosts and web properties with similar characteristics. Through this, analysts can discover and monitor adversarial assets as threats evolve in real time.

The module's Live Discovery and Scanning functions provide real-time threat detection and validation. These allow for on-demand scanning, exposing unknown configurations and systematically analysing active services and endpoints to confirm potential threats and observe configuration changes over time.

Exploration Dashboards offer users interactive visualisation of threat frameworks. This functionality supports investigation by allowing users to explore data, detect, and analyse trends or anomalies that may signify emerging threats.

A Certificate and Host History Visualisation feature gives hunters the ability to examine past relationships between hosts and SSL or TLS certificates. By doing so, teams can build timelines of weaponisation, detect adversary tactics and techniques, and leverage historical data as part of their detection strategies.

For advanced investigation, the platform includes configuration-based hash capabilities such as JARM, JA3, JA4+, and favicon hashes. These allow teams to expand their view of related infrastructure, providing a more comprehensive understanding through indicator correlation.

Brad Brooks, CEO of Censys, commented: "The new Censys Threat Hunting Module gives organisations unprecedented visibility, context, and historical insights to every Internet facing asset, including known and emerging adversarial infrastructure. With the new module, enterprise security teams and government agencies can proactively hunt for sophisticated threats targeting their organisation using the industry's most accurate and comprehensive Internet Intelligence data set."

The Censys Threat Hunting module is aimed at providing both private sector enterprises and public sector agencies the capacity to monitor, identify and investigate sophisticated threats across their Internet-facing infrastructure, using a unified and up-to-date data set. The company aims for this solution to strengthen the ability of security teams to anticipate, track, and stop cyber adversaries before incidents escalate into security breaches.