Mastering ANY.RUN TI Lookup: Building High‑Fidelity Threat Hunting Queries with IOCs, IOAs & IOBs

·

Introduction

Threat hunting often fails not because defenders lack data, but because they can’t pivot quickly from one artifact (a domain, a hash, a command line) to the broader campaign context. ANY.RUN’s Threat Intelligence Lookup (TI Lookup) is built for that pivot: it enables fast searches across indicators and sandbox-recorded behavior to enrich investigations and accelerate triage. [TI_Lookup_...y_Guide_v6 | PDF], [cisa.gov]

This blog breaks down the TI Lookup Query Guide into a practical workflow for SOC analysts: how to choose the right search mode, which fields matter most, how to use wildcards/operators correctly, and how to set up notifications for continuous monitoring.

Background / Overview

What TI Lookup is (and why it’s useful)

TI Lookup is described as a tool that simplifies threat investigations through flexible searches for:

  • IOCs (Indicators of Compromise)

  • IOAs (Indicators of Attack)

  • IOBs (Indicators of Behavior)

It is designed to help analysts:

  • Gather extensive threat context quickly

  • Receive real-time updates on searches

  • Enrich intelligence with indicators and samples analyzed by threat analysts

  • Leverage a continuously updated database sourced from millions of public sandbox tasks contributed by a large analyst community

What makes TI Lookup different from “simple IOC lookups”

Traditional IOC lookups answer: “Is this hash known?”
TI Lookup helps answer: “Where else has this appeared, what behavior surrounded it, and what other artifacts co-occurred?”—because it supports queries across process, network, registry, file, Suricata, and MITRE ATT&CK-mapped fields recorded in sandbox sessions.

Technical Breakdown / Analysis

This section translates the PDF guide into a “how-to” workflow.

1) Choose the right search type

TI Lookup supports four main search approaches:

A) Single IOC Search

Use when you have one strong artifact:

  • URL, domain, IP, MD5/SHA1/SHA256 hash

When to use

  • You have a domain from DNS logs

  • A hash from EDR quarantine

  • A URL from a phishing email

B) Combined Search

Use when you want co-occurrence: indicators/events discovered together in the same sandbox session, even if they represent different stages of attack.

When to use

  • You want “domains + process name + registry persistence” as a single pivot

  • You want to reduce noise by requiring relationships between artifacts

C) Events Search

Use when you’re hunting by behavioral telemetry:

  • Launched processes, triggered Suricata rules, registry modifications, command executions, mutexes, and more

When to use

  • You have suspicious PowerShell patterns

  • You want to find samples that trigger a specific IDS signature

  • You are correlating persistence mechanisms

D) Wildcard Search

Use when you have partial/variable data and need flexible matching using wildcards:

  • *, ^, $, ?

2) Use high-value fields (query parameters) like a pro

TI Lookup exposes a large set of searchable parameters across threat metadata and telemetry. Below are the ones SOC teams typically operationalize first.

Threat and task context fields

  • threatName (malware family or threat type, as identified by sandbox)

  • submissionCountry (country the sample was submitted from)

  • taskType (e.g., URL)

  • threatLevel (verdict / severity)

Practical use

  • Narrow to “malicious URL tasks submitted recently from region X”

  • Filter your hunting to a specific malware family name (when already known)

Registry telemetry fields

  • registryKey (use double backslashes \\ to escape)

  • registryName

  • registryValue

Practical use

  • Hunt persistence: Run, RunOnce, service keys, scheduled tasks keys (depending on what your IR found)

Environment fields

  • os (Windows version)

  • osSoftwareSet (installed software set, e.g., “clean”)

  • osBitVersion (32/64-bit)

Practical use

  • Filter out behaviors that only reproduce on specific OS versions

  • Match your organization’s endpoint baseline

Detection and ATT&CK mapping fields

  • ruleName (detection rule name)

  • ruleThreatLevel

  • MITRE (e.g., technique IDs like T1071)

Practical use

  • Build ATT&CK-driven hunts (“show me sessions mapped to T1071”)

  • Track detections triggered by droppers or LOLBins

Network + TLS fingerprint fields

  • domainName

  • destinationIP, destinationPort

  • destinationIpAsn, destinationIPgeo

  • TLS fingerprints: ja3, ja3s, jarm

Practical use

  • Pivot from a suspicious IP → domains → related malware family sightings

  • Identify “same TLS fingerprint, different domains” patterns for infra clustering

Process telemetry fields

  • imagePath (full path to the executable)

  • commandLine (complete command line)

  • injectedFlag (process injection indicator)

Practical use

  • Hunt suspicious LOLBin usage by commandLine

  • Find injection-heavy samples (injectedFlag:true) for higher-risk triage

Suricata / network threat fields

  • suricataMessage, suricataClass

  • suricataID, suricataThreatLevel

Practical use

  • Reuse IDS detection names/IDs as pivots

  • Validate whether your own Suricata alerts align with known sandbox behaviors

File telemetry fields

  • filePath, fileEventPath

  • fileExtension

  • Hash fields: sha256, sha1, md5

Practical use

  • Identify lure themes by path/filename patterns (e.g., “invoice”, “factura”)

  • Pivot from a single hash to related artifacts in other sessions

Synchronization (mutex/objects) fields

  • syncObjectName, syncObjectType, syncObjectOperation

Practical use

  • Identify malware families that reuse mutex naming conventions

URL + HTTP content type fields

  • URL (called by a process)

  • httpRequestContentType, httpResponseContentType

  • httpRequestFileType, httpResponseFileType

Practical use

  • Detect downloaders or exfil patterns (binary uploads/downloads)

  • Identify “HTML response then binary stage 2” patterns

3) YARA Search: use sandbox-backed matching for scale

TI Lookup includes YARA Search as a core capability, enabling custom YARA rules to scan the TI dataset and identify matching files. The guide highlights:

  • A built-in rule editor

  • Ability to explore real-world sandbox sessions for matched files

  • Efficient parallel searching with fast initial results

Defensive workflow

  1. Write a YARA rule for the family/pattern you care about

  2. Run it in TI Lookup

  3. For matches, pivot into related network/process indicators and update detections (SIEM/EDR/IDS)

4) Wildcards & operators (the difference between noisy and surgical hunts)

Wildcards

  • * matches any number of characters (often implicitly applied)

  • ^ anchors “starts with” (e.g., MITRE:"^T108")

  • $ anchors “ends with” (e.g., file names ending in .cmd)

  • ? matches a single character (or absence)

Logical operators

  • AND, OR, NOT plus parentheses for grouping

Practical examples (defensive intent)

  • Reduce noise: require a process and a network artifact in the same session (Combined Search)

  • Exclude known-benign: use NOT filters on common false positives

5) Turn TI Lookup into “continuous monitoring” with notifications

TI Lookup supports real-time updates on malware/phishing campaigns and indicators, and you can subscribe to a query using the bell icon. The guide describes:

  • Enter query → click bell → results appear in sidebar

  • Manage subscriptions via menu (unsubscribe/pin/delete/mark viewed)

SOC operationalization

  • Subscribe to your top 10 watch queries (top malware families targeting your region/industry, key TTPs, high-risk infrastructure patterns)

  • Create an escalation workflow: new matching result → enrich alert → update blocklists or detections

Detection & Defense

Here’s how to use TI Lookup output in real SOC pipelines.

Detection engineering ideas

  • SIEM watchlists: convert high-confidence domains/IPs to watchlists with expiry and confidence scoring. (TI Lookup is built to provide contextual artifact relationships, which supports prioritization.)

  • ATT&CK-driven rules: translate MITRE technique pivots into detection coverage reviews—e.g., if TI Lookup shows repeated T1071 patterns, validate you have robust network/endpoint telemetry coverage.

  • Command-line detections: create rules for abnormal commandLine patterns discovered via Events Search, then tune with NOT and grouping to reduce noise.

  • Network IDS tuning: pivot on suricataID/suricataMessage to validate if your Suricata alert aligns with known malicious behavior in sandbox sessions.

Defensive hunting playbook (repeatable)

  1. Start with Single IOC: domain/hash from your alert.

  2. Pivot to Combined Search: require co-occurrence with suspicious process or TLS fingerprint.

  3. Use Events Search: find repeated behaviors (registry keys, injection flags, Suricata triggers).

  4. Expand coverage with YARA Search: identify related samples at scale.

  5. Subscribe to the refined query for ongoing intelligence updates.

Remediation & Best Practices

1) Standardize your query library

Create a shared internal “TI Lookup Query Pack” with:

  • Common malware families (threatName) your org sees

  • Your top ATT&CK techniques (MITRE)

  • Known bad ASNs or geos (when relevant)

  • Common lures (e.g., invoice-themed paths) using wildcard patterns

2) Use precision controls to prevent alert fatigue

  • Prefer AND with co-occurrence to reduce irrelevant matches.

  • Use anchors (^, $) to avoid overly broad wildcarding.

  • Exclude with NOT for known benign patterns.

3) Treat subscriptions as a “mini TI feed”

Subscriptions are most effective when they’re:

  • Limited to high-signal queries

  • Reviewed periodically (retire noisy ones)

  • Integrated into triage playbooks (who checks, when, what action follows)

4) Close the loop: intel → detection → validation

Use TI Lookup results to:

  • Add or tune detections (SIEM/EDR/IDS)

  • Validate behavior coverage through sandbox sessions

  • Re-hunt with improved query precision

Key Takeaways

  • TI Lookup supports hunting across IOCs, IOAs, and IOBs—not just single indicators.

  • The biggest performance gain comes from choosing the right search mode: Single IOC for quick context, Combined for high-fidelity pivots, Events for behavior hunts, and Wildcards for partial data.

  • Operationalize the platform by building a reusable query library, using wildcards/operators precisely, and subscribing to high-signal searches for continuous updates.

References

  • ANY.RUN — TI Lookup Query Guide v6 (PDF) (search types, fields, wildcards, operators, subscriptions, YARA search).

  • ANY.RUN — TI Lookup product overview (contextual searches & threat enrichment positioning).

  • ANY.RUN — Threat Intelligence Reports overview (how reports structure TTPs/IOCs and link to lookup pivots).

Brief Summary

This guide shows how to use ANY.RUN TI Lookup as a SOC-ready threat hunting engine: select the right query type, pivot across process/network/registry/file telemetry, apply wildcards and operators correctly, scale matching with YARA searches, and subscribe to high-signal queries for continuous intel updates.

Connect & Stay Updated

  • Sign up FREE for my web app: https://app.cyberhawkthreatintel.com

  • YouTube: https://www.youtube.com/@cyberhawkconsultancy • https://www.youtube.com/@cyberhawkk

  • TikTok: https://www.tiktok.com/@cyberhawkthreatintel

  • X (Twitter): https://twitter.com/cyberhawkintel

  • Telegram: https://t.me/cyberhawkthreatintel

Hashtags & SEO keywords
#ThreatIntel #ThreatHunting #ANYRUN #TILookup #IOC #IOA #IOB #YARA #MITREATTACK #SOC #DFIR #DetectionEngineering #cyberhawktheatintel #cyberhawkconsultancy #cyberhawkk