A fascinating summary from an information security group about the use of ChatGPT for IoC (Indicator of Compromise) detection tests.
From a Kaspersky article that talks about ChatGPT (it’s time we talked a little about it).
Recently, there have been many articles and posts about using ChatGPT for protection and attack. By and large, most security companies publish IOCs as well as TTPs (Tactics, Techniques, and Procedures) that they find in reports, articles, tweets, etc.
So Kaspersky started to play with the chat and see what it knows about IOCs.
At first it was a partial success – it was good when they gave it file names and paths, less so when they gave it known malicious hashes or asked it about APTs domains. They moved towards automation and asked the chat to write a script that would extract paths from the Autoruns on a remote computer, and query its API to check if the paths are IOCs and potentially malicious.
In the end, they developed a package of scripts that do network hunting using ChatGPT and looked at several kinds of artifacts: Autoruns, processes, services, running powershell, creating certain event logs.
They tested the scripts on a sample position and achieved detection with very few false positives.
Eventually, we can see it is not yet perfect, but at the very least, the use of ChatGPT can reduce the work time of a human researcher (drastically reduces the amount of jumps.) You understand it is accessible and there is a lot of potential.
