USTA Account Takeover Prevention

USTAv4 Account Takeover Prevention is designed to collect compromised credentials sourced from stealer malware attacks, helping organizations identify potential account takeovers and enhance their security posture. Provided by PRODAFT.
This integration was integrated and tested with version 4.1.0 of USTAv4 Account Takeover Prevention.

Configure USTAv4 Account Takeover Prevention in Cortex

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for USTAv4 Account Takeover Prevention.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Your server URL		True
   API Key	The API Key to use for connection	True
   Fetch incidents by status		False
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Fetch incidents		False
   First Fetch Time	The time range to consider for the initial data fetch. Warning: Fetching a large time range may cause performance issues!	True

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

usta-atp-search-username

Search for compromised credentials by username

Base Command

usta-atp-search-username

Input

Context Output

Command Example

!usta-atp-search-username username=user123456 page_size=1 page=1

Context Example

{
    "USTA" : {
        "AccountTakeoverPrevention": [
            {
                "id": 1234567,
                "status": "open",
                "username": "user123456",
                "password": "******",
                
                "url": "https://example.com/login",
                "is_corporate": "False",                
                "created": "2024-11-18T00:00:00.000000Z",
                "victim_detail": {
                    "username": "anonymous",
                    "ip": "0.0.0.0",
                    "country": "Unknown",
                    "phone_number": "N/A",
                    "computer_name": "DESKTOP-XXXXX",
                    "victim_os": "OS x64",
                    "language": "N/A",
                    "memory": "XXXX MB",
                    "cpu": "Generic CPU",
                    "gpu": "Generic GPU",
                    "malware": "Unknown",
                    "infection_date": "N/A",
                    "created": "2024-11-18T00:00:00.000000Z"
                }
            }
        ]
    }
}