Whisper Security - Co-Hosted Malware Cluster Detection

Original query, unchanged.

// MITRE ATT&CK: T1584.001 - Compromise Infrastructure: Domains
// Tactic: Resource Development
// Detects clusters of malware-hosting domains sharing the same IP infrastructure
let minCohostedCount = 3;
let minMalwareCoHosts = 3;
let cohostedInfra = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where cohostedCount > minCohostedCount
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project indicator, parsedIp, cohostedCount, countries, registrar;
let malwareIndicators = WhisperThreatIntel_CL
    | where TimeGenerated > ago(1d)
    | where isMalware == true
    | project indicator, threatScore, threatLevel, feedNames;
cohostedInfra
    | join kind=inner (malwareIndicators) on indicator
    | summarize malwareCoHostCount = dcount(indicator), DnsDomains = make_set(indicator, 10), avgThreatScore = avg(threatScore), maxThreatScore = max(threatScore) by parsedIp, cohostedCount, countries, registrar
    | where malwareCoHostCount >= minMalwareCoHosts
    | extend DnsDomain = tostring(DnsDomains[0]), IPAddress = parsedIp
    | project TimeGenerated = now(), DnsDomain, IPAddress, malwareCoHostCount, cohostedCount, avgThreatScore, maxThreatScore, countries, registrar, DnsDomains