USTA Account Takeover Prevention

Details

ID	`USTA Account Takeover Prevention`
Provider	PRODAFT
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

USTAv4 Account Takeover Prevention is designed to collect compromised credentials sourced from stealer malware attacks, helping organizations identify potential account takeovers and enhance their security posture. Provided by PRODAFT.
This integration was integrated and tested with version 4.1.0 of USTAv4 Account Takeover Prevention.

Configure USTAv4 Account Takeover Prevention in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for USTAv4 Account Takeover Prevention.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Your server URL		True
API Key	The API Key to use for connection	True
Fetch incidents by status		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
First Fetch Time	The time range to consider for the initial data fetch. Warning: Fetching a large time range may cause performance issues!	True

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

usta-atp-search-username

Search for compromised credentials by username

Base Command

usta-atp-search-username

Input

Argument Name	Description	Required
username	Username to search.	Required
page_size	Number of result that should appear on each page.	Optional
page	1-indexed page number to get a particular page of results.	Optional

Context Output

Path	Type	Description
USTA.AccountTakeoverPrevention.id	Number	The ID of the alert
USTA.AccountTakeoverPrevention.username	String	The username of the compromised credential
USTA.AccountTakeoverPrevention.password	String	The password of the compromised credential
USTA.AccountTakeoverPrevention.url	String	The URL of the compromised credential
USTA.AccountTakeoverPrevention.is_corporate	Boolean	Whether the compromised credential is corporate
USTA.AccountTakeoverPrevention.created	String	The creation date of the compromised credential
USTA.AccountTakeoverPrevention.victim_detail.ip	String	The IP address of the victim
USTA.AccountTakeoverPrevention.victim_detail.country	String	The country of the victim
USTA.AccountTakeoverPrevention.victim_detail.phone_number	String	The phone number of the victim
USTA.AccountTakeoverPrevention.victim_detail.computer_name	String	The computer name of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.victim_os	String	The OS of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.language	String	The language of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.memory	String	The memory of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.cpu	String	The CPU of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.gpu	String	The GPU of the victim computer
USTA.AccountTakeoverPrevention.victim_detail.malware	String	The family of the malware that infected the victim computer
USTA.AccountTakeoverPrevention.victim_detail.infection_date	String	The infection date of the victim computer

Command Example

!usta-atp-search-username username=user123456 page_size=1 page=1

Context Example

{
    "USTA" : {
        "AccountTakeoverPrevention": [
            {
                "id": 1234567,
                "status": "open",
                "username": "user123456",
                "password": "******",
                
                "url": "https://example.com/login",
                "is_corporate": "False",                
                "created": "2024-11-18T00:00:00.000000Z",
                "victim_detail": {
                    "username": "anonymous",
                    "ip": "0.0.0.0",
                    "country": "Unknown",
                    "phone_number": "N/A",
                    "computer_name": "DESKTOP-XXXXX",
                    "victim_os": "OS x64",
                    "language": "N/A",
                    "memory": "XXXX MB",
                    "cpu": "Generic CPU",
                    "gpu": "Generic GPU",
                    "malware": "Unknown",
                    "infection_date": "N/A",
                    "created": "2024-11-18T00:00:00.000000Z"
                }
            }
        ]
    }
}

Configuration parameters

url — Your server URL (required)
api_key — API Key (required)
status — Fetch incidents by status
max_fetch — Maximum number of alerts per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
first_fetch — First Fetch Time (required)

Commands (1)

usta-atp-search-username
Search for compromised credentials by username.

Source

USTAAccountTakeoverPrevention.py USTAAccountTakeoverPrevention_test.py USTAAccountTakeoverPrevention.yml USTAAccountTakeoverPrevention_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: PRODAFT
sectionorder:
- Connect
- Collect
description: 'Collects compromised credentials sourced from stealer malware attacks, helping organizations identify potential account takeovers and enhance their security posture. Provided by PRODAFT.'
display: USTAv4 Account Takeover Prevention
name: USTA Account Takeover Prevention
defaultclassifier: USTA Incident Classifier
defaultmapperin: USTA Incident Mapper
defaultmapperout: 'null'
commonfields:
  id: USTA Account Takeover Prevention
  version: -1
configuration:
- defaultvalue: https://usta.prodaft.com/
  display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  additionalinfo: The API Key to use for connection
  name: api_key
  required: true
  type: 4
  section: Connect
- display: Fetch incidents by status
  defaultvalue: All
  name: status
  options:
  - All
  - Open
  - Closed
  type: 15
  required: false
  section: Collect
- defaultvalue: '100'
  display: Maximum number of alerts per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  advanced: true
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: First Fetch Time
  additionalinfo: 'The time range to consider for the initial data fetch. Warning: Fetching a large time range may cause performance issues!'
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  required: true
  section: Connect
script:
  commands:
  - arguments:
    - description: 'Username to search.'
      name: username
      required: true
    - description: Number of result that should appear on each page.
      name: page_size
    - description: 1-indexed page number to get a particular page of results.
      name: page
    description: 'Search for compromised credentials by username.'
    name: usta-atp-search-username
    outputs:
    - contextPath: USTA.AccountTakeoverPrevention.id
      description: The ID of the alert.
      type: Number
    - contextPath: USTA.AccountTakeoverPrevention.username
      description: The username of the compromised credential.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.password
      description: The password of the compromised credential.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.url
      description: The URL of the compromised credential.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.is_corporate
      description: Whether the compromised credential is corporate.
      type: Boolean
    - contextPath: USTA.AccountTakeoverPrevention.created
      description: The creation date of the compromised credential.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.ip
      description: The IP address of the victim.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.country
      description: The country of the victim.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.phone_number
      description: The phone number of the victim.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.computer_name
      description: The computer name of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.victim_os
      description: The OS of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.language
      description: The language of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.memory
      description: The memory of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.cpu
      description: The CPU of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.gpu
      description: The GPU of the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.malware
      description: The family of the malware that infected the victim computer.
      type: String
    - contextPath: USTA.AccountTakeoverPrevention.victim_detail.infection_date
      description: The infection date of the victim computer.
      type: String
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)