--- title: Using Selectors For Open Source Intelligence description: Selectors are a building block of open source intelligence collection and investigations, but context is important to use the well. image: https://blog.nisos.com/hubfs/selectoruse.png --- - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) [![Nisos-Logo-Blue](https://blog.nisos.com/hubfs/Nisos-Logo-Blue.png) ![Nisos-Logo-White](https://blog.nisos.com/hubfs/Nisos-Logo-White.png) ![Nisos-Logo-Blue](https://blog.nisos.com/hubfs/Nisos-Logo-Blue.png)](https://www.nisos.com/) - [Default HubSpot Blog](https://blog.nisos.com/blog) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) ### Solutions Managed Intelligence solutions are designed to address your needs in an evolving risk landscape. Empower your organization with methodologies and actionable results tailored to the innovative ways adversaries are targeting you. ### Mitigate Advanced Threat Actors Inform your security operations with greater context answering the “how” and “why” of the threat actors you face. ### Counter Disinformation Enable informed business responses with the “who” and “why” behind coordinated campaigns. ### Mitigate Insider Threats Improve your program’s ability to get to “who” and “what” with technical program building and investigations. ### Stop Platform Abuse Take action against nefarious use of your platforms with the “who” and “how” of threat actors targeting them. ### Cyber Diligence for Mergers and Acquisitions Facilitate a smooth transition with the “what” and “why” of the security risks to your acquisition. ### Third Party Risk Dilligence Increase the effectiveness of your security evaluations with specifics on the “where” and “what” of your third party risk profile. ### Services Access a world-class intelligence capability tailored to your specific needs. Control a multi-million dollar program without the time or expense and solve problems both lasting and acute. ### Managed Intelligence Ongoing risks, whether from one threat actor or many, require persistent focus. Leverage skills, data, and technology to harden your defenses. ### Security Investigations Gain the context needed to make informed decisions during periods of heightened risk. ### What is Managed Intelligence? ## Technical Blogs ###### 5 min read # [Using Selectors For Open Source Intelligence](https://blog.nisos.com/technical-blogs/using_selectors_open_source_intelligence) Oct 20, 2020 10:12:23 AM - [Tweet](https://twitter.com/share) A “selector” is not a generally defined term in enterprise security, but selectors are important for understanding open source intelligence and investigations in the digital realm. Building on our previous [technical blog](https://www.google.com/url?q=https://www.nisos.com/technical-blogs/what_is_a_selector&sa=D&ust=1603203634742000&usg=AOvVaw3LNEMQqvD-6nmIOQ4a1s31) defining a selector, we will be diving deeper into selectors and how they enable external threat hunting, attribution, and open source intelligence analysis. **Criticality of Uniqueness** Using selectors, we can identify specific entities that are unique in a digital realm that allow us to understand  the “how,” “why,” and potentially “who” of suspicious activity. With this context, organizations can decide if they should dedicate resources chasing the threat.  Selectors are entities such as MAC addresses, email addresses, phone numbers, and IP addresses. Each one of these entities allows us to analyze it to determine how unique it is, and then potentially correlate it with other selectors and the entity where we found it.  We can then cross reference that selector in other data for greater refinement and enrichment.  **Data Engineering Considerations for Selectors** The first consideration for aggregating data and selectors is mapping to a common data model. An organization needs to be able to identify the elements of a particular data set that are shared amongst the other data they have.  They need to consider the fields to capture in the data and how they want to standardize the data, all in the context of the investigative problem they are trying to solve. **Availability** The availability of the data is an added component in the data aggregation and engineering process.  Key questions and considerations include: - How many data sources can you find that include a specific selector? - How expensive are those data sources?  - How reliable are they?  - How well documented are they?  The quality of documentation leads to how much community knowledge there is about that type of selector. **Provenance** When aggregating data for analysis, the provenance of data - that is, the ability to identify the source of the data - is probably the most critical element from a data engineering standpoint.  For example, during an investigation, if we discovered an email address associated with a password, and another email address associated with the same password, we might conclude they are likely the same individual.  However, it’s critical to know where those two sets of usernames and passwords came from. If we can't track back to the specific data set, then we can’t know whether this shared password is coincidence or correlation.  **Usability of Data** Finally, the usability of the data sets as a whole contribute to our ability to use the selector individually. Questions to ask include: - What is the volume of data that an organization is going to have to absorb?  - What is the density of the information or significant information?  For example if an organization has to review multiple petabytes from a single data source in order to find the one or two useful selectors, they are probably consuming the wrong dataset.  **Operationalizing Data Engineering for Open Source Intelligence** As an analyst, it’s important to understand not only what data is available, but how that data is relevant to an investigative problem being solved. Ultimately, an analyst must be able to use data in a time sensitive manner. For example, a phone number without a country code or an area code would be very easy to confuse with multiple other phone numbers that look the exact same. If the analyst does not have a good sense of where that data came from, they could be using the wrong selector for their use case.  Further, if an analyst does not want to make multiple queries, the data engineers may have to store multiple variants of the data in the organization’s data model, thus increasing the amount of data stored.  For example, an organization might want to store password data from third-party breaches to alert their security team if employees have non-service credentials that match corporate account credentials.  They might want to store hashes of those passwords also so that they automatically find correlations and hits off of the passwords.  If they’re trying to automate discovery and detection across their system, having data stored in specific ways is required because they need the system to be able to look across all elements and all variations necessary. However, if an organization is conducting on-demand analysis to minimize data storage requirements, this prevents it from being able to perform appropriate discovery.   **Importance of Context** A key element for an analyst to understand is the context of a data set used for a query. This context is largely dependent on the elements of the data described above. Since selectors are often the basic building blocks of analytical conclusions, bad context could lead to inaccurate intelligence analysis.  Therefore it’s critical for analysts to have an idea what goes into the backend data engineering regarding availability, usability, and provenance of selectors.   For example, it’s very helpful to know the Organizationally Unique Identifier (OUI) tied to a MAC address. If an analyst is familiar with the data model they are using, they can request the engineers tag any MAC address with the OUI. In addition to understanding the data model itself, it’s also important for the analyst to know there might be data that isn't being returned during a query.  This is often where enrichment falls short.  If an analyst is querying a specific IP address, knowing the timestamp that's associated with that IP address is very important. If an analyst doesn't understand the data model, they might not know if they do or don’t have an IP address with a timestamp.  If the analyst’s query doesn't return that element, there might be instances when an analyst doesn’t see the data that is relevant because the query tool isn’t properly tuned for the query the analyst is running. **Bringing Together the Framework During an Investigation** In a recent investigation, we were tasked to investigate a mobile application which was being used for fraud. We were able to identify the developer certificate within the application. The certificate was a very valuable selector when judged against the following criteria: **Scope**:  Scope explains which systems can access the identifier. Developer certificates were single scoped to a very specific realm. **Uniqueness**:  Uniqueness establishes the likelihood that identical identifiers exist within the associated scope. This selector was unique because one developer certificate was assigned per developer. **Reset-ability and Persistence**:  Reset-ability and persistence define the lifespan of the identifier and explain how it can be reset. In this instance, the certificate can not be reset, so it is one hundred percent persistent. **Integrity**:  A selector that is difficult to spoof or replay can be used to prove that the associated device or account has certain properties. We know the developer certificate can't be spoofed because it's defined by the development platform  within its own unique systems. **Non-Repudiation**:  Non-repudiation means the service provides proof of the integrity and origin of data creating an authentication that can be said to be genuine with high confidence. There isn't necessarily proof of non-repudiation, but the developer certificates are single sourced and by the provider, which in this case was a trusted provider.  **Provenance:** Provenance provides the ability to trace information to the source of the data. Similar to non-repudiation, the development platform is the source. Based on this evaluation, the developer certificate was an excellent starting point to obtain additional context about the actor group that represents a threat, in this instance app-based fraud. Ultimately, we were able to work with the developer platform to remove the account being used for fraud, which not only shut down this fraudulent app, but prevented the developer from using the same infrastructure to develop other apps as well. To learn more about selectors and how investigators can use them, check out this [episode](https://www.google.com/url?q=https://www.nisos.com/podcast/cyber5_episode27_defining_selectors_digital_crime&sa=D&ust=1603205772056000&usg=AOvVaw2C_NWGhTvBAELF8Gtnq5qs) of the Cyber5 podcast. Topics: [Cybersecurity](https://blog.nisos.com/technical-blogs/topic/cybersecurity) [Adversary](https://blog.nisos.com/technical-blogs/topic/adversary) [OSINT](https://blog.nisos.com/technical-blogs/topic/osint) ##### Written by [Adam Gayde, Robert Raines, and Matthew Brock](https://blog.nisos.com/technical-blogs/author/adam-gayde-robert-raines-and-matthew-brock) ###### [Previous Post](https://blog.nisos.com/technical-blogs/myth_complex_passwords) [![](https://blog.nisos.com/hubfs/pwreuse-01.png)](https://blog.nisos.com/technical-blogs/myth_complex_passwords) ###### [The Myth of Complex Passwords](https://blog.nisos.com/technical-blogs/myth_complex_passwords) ### Post a Comment ### Sign up for updates ### Featured ![](https://blog.nisos.com/hubfs/Nisos-Logo-White.png) Responsive strategies and intelligent defenses for protecting your enterprise. - Services - Managed Intelligence - Security Investigations - Why Nisos - Company - Resources - [Blog](https://blog.nisos.com/blog) - [Case Studies](https://blog.nisos.com/case-studies) - [White Papers](https://blog.nisos.com/technical-blogs) - [Podcast](https://blog.nisos.com/podcast) - [News](https://blog.nisos.com/news) - Contact ###### Contact Us [1-703-382-8400](tel:1-703-382-8400) [info@nisos.com](mailto:info@nisos.com) 603 King Street, Suite 300 Alexandria, VA 22314 [![Learn More](https://no-cache.hubspot.com/cta/default/6068438/043dbe58-e265-499f-8574-2e0d1b4d410e.png)](https://cta-redirect.hubspot.com/cta/redirect/6068438/043dbe58-e265-499f-8574-2e0d1b4d410e) ©2020 Nisos. All rights reserved. - Terms - Cookie Policy - Privacy Policy ![](https://px.ads.linkedin.com/collect/?pid=1593266&fmt=gif)