dnstwist

Use the DNSTwist integration to detect typosquatting, phishing, and corporate espionage.

Data Enrichment & Threat Intelligence · Dnstwist

Details

ID	`dnstwist`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/dnstwist:1.0.0.10158186`
Supported Modules	Agentix XSIAM

README

Cortex XSOAR interfaces with dnstwist to research what sort of trouble users can get in trying to type a domain name. Find similar-looking domains that adversaries can use for attacking. dnstwist detect typosquatting, phishing attacks, fraud, and corporate espionage. Useful as an additional source of targeted threat intelligence.

The integration uses Docker image demisto/dnstwist:1.0.

Use Cases

dnstwist takes in a domain name as a seed, generates a list of potential phishing domains, and then checks to see if they are registered.

Additionally, it can test if the mail server from MX (mail exchange) record can be used to intercept misdirected corporate e-mails, and it can generate fuzzy hashes of the web pages to see if they are live phishing sites.

Configure dnstwist on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for dnstwist.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.

Click Test to validate the new instance.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Check domain variations: dnstwist-domain-variations

1. Check domain variations

Checks domain variations.

Base Command

dnstwist-domain-variations

Input

Argument Name	Description	Required
domain	The domain name for which to check for variations.	Required
limit	Maximum number results to return in the context. This helps manage browser performance. The Markdown entry will display all results.	Optional
whois	Whether to perform a query for the Whois creation or last updated time (slow).	Optional

Context Output

Path	Description
dnstwist.Domain.Domains.Name	Domain name variations.
dnstwist.Domain.Domains.IP	IP addresses that resolved to domain name variations.
dnstwist.Domain.Domains.DNS-MX	Mail exchange records that resolved to domain name variations.
dnstwist.Domain.Domains.DNS-NS	Server names that resolved to domain name variations.
dnstwist.Domain.Domains.WhoisUpdated	Whois updated for domain name variations.
dnstwist.Domain.Domains.WhoisCreated	Whois created for domain name variations.

Command Example

!dnstwist-domain-variations domain=demisto.com

Context Example

"dnstwist":
 {
  "Domain": {
    "Name": "demisto.com",
    "IP" : ["85.13.155.169"]
    "Domains": [
       {
       "Name": "demistok.com",
              "IP": ["52.86.122.241","54.165.193.163"]
              },
       {
        "Name": "demistol.com",
               "IP": ["85.13.155.169"]
              }
     ]
   }
 }

Human Readable Output

Commands (1)

dnstwist-domain-variations
Checks for variations of a phishing domain name.

Source

dnstwist.py dnstwist.yml dnstwist_description.md

Download History Raw

import json
import subprocess

from CommonServerPython import *

TWIST_EXE = "/dnstwist/dnstwist.py"

if demisto.command() == "dnstwist-domain-variations":
    KEYS_TO_MD = ["whois_updated", "whois_created", "dns_a", "dns_mx", "dns_ns"]
    DOMAIN = demisto.args()["domain"]
    LIMIT = int(demisto.args()["limit"])
    WHOIS = demisto.args().get("whois")

    def get_dnstwist_result(domain, include_whois):
        args = [TWIST_EXE, "-f", "json"]
        if include_whois:
            args.append("-w")
        args.append(domain)
        res = subprocess.check_output(args, stderr=subprocess.DEVNULL)
        return json.loads(res)

    def get_domain_to_info_map(dns_twist_result):
        results = []
        for x in dns_twist_result:
            temp = {}  # type: dict
            for k, v in x.items():
                if k in KEYS_TO_MD:
                    if x["domain"] not in temp:
                        temp["domain-name"] = x["domain"]
                    if k == "dns_a":
                        temp["IP Address"] = v
                    else:
                        temp[k] = v
            if temp:
                results.append(temp)
        return results

    dnstwist_result = get_dnstwist_result(DOMAIN, WHOIS == "yes")
    new_result = get_domain_to_info_map(dnstwist_result)
    md = tableToMarkdown(
        "dnstwist for domain - " + DOMAIN,
        new_result,
        headers=["domain-name", "IP Address", "dns_mx", "dns_ns", "whois_updated", "whois_created"],
    )

    domain_context = new_result[0]  # The requested domain for variations
    domains_context_list = new_result[1 : LIMIT + 1]  # The variations domains

    domains = []
    for item in domains_context_list:
        temp = {"Name": item["domain-name"]}
        if "IP Address" in item:
            temp["IP"] = item["IP Address"]
        if "dns_mx" in item:
            temp["DNS-MX"] = item["dns_mx"]
        if "dns_ns" in item:
            temp["DNS-NS"] = item["dns_ns"]
        if "whois_updated" in item:
            temp["WhoisUpdated"] = item["whois_updated"]
        if "whois_created" in item:
            temp["WhoisCreated"] = item["whois_created"]
        domains.append(temp)

    ec = {"Domains": domains}
    if "domain-name" in domain_context:
        ec["Name"] = domain_context["domain-name"]
    if "IP Address" in domain_context:
        ec["IP"] = domain_context["IP Address"]
    if "dns_mx" in domain_context:
        ec["DNS-MX"] = domain_context["dns_mx"]
    if "dns_ns" in domain_context:
        ec["DNS-NS"] = domain_context["dns_ns"]
    if "whois_updated" in domain_context:
        ec["WhoisUpdated"] = domain_context["whois_updated"]
    if "whois_created" in domain_context:
        ec["WhoisCreated"] = domain_context["whois_created"]

    entry_result = {
        "Type": entryTypes["note"],
        "ContentsFormat": formats["json"],
        "Contents": dnstwist_result,
        "HumanReadable": md,
        "ReadableContentsFormat": formats["markdown"],
        "EntryContext": {"dnstwist.Domain(val.Name == obj.Name)": ec},
    }

    demisto.results(entry_result)

if demisto.command() == "test-module":
    # This is the call made when pressing the integration test button.
    subprocess.check_output([TWIST_EXE, "-h"], stderr=subprocess.STDOUT)
    demisto.results("ok")
    sys.exit(0)