Darkmon - Brand-Targeted NRD Watch

Daily sweep of newly-registered domains. Each candidate's root label is compared against the brand list via DarkmonLevenshtein; matches with distance <= 2 (configurable) open a 'Darkmon Typosquatting Threat' incident.

Darkmon · 9 tasks · 1 input · 1 output

Details

IDDarkmon - Brand-Targeted NRD Watch
From Version6.8.0
Tasks9
Tagsdarkmon monitoring brand-protection

README

Daily sweep of newly-registered domains. Each candidate’s root label is compared against the brand list via DarkmonLevenshtein; matches with distance <= 2 (configurable) open a ‘Darkmon Typosquatting Threat’ incident.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Darkmon - Generic Notify

Integrations

  • Darkmon

Scripts

  • DarkmonCreateIncidents
  • DarkmonFilterUnseen
  • DarkmonScoreNRDs

Commands

  • dmontip-get-nrd

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path Description Type
Typosquats NRD entries flagged as typosquats with their best-match brand and distance. unknown

Inputs

  • MaxDistance — Maximum Levenshtein distance between a newly registered domain root label and any brand in the Darkmon - Brand Names list for the NRD to be flagged as a typosquatting candidate. Defaults to 2. Lower (1) for stricter brand-protection, raise (3) for broader recall.

Outputs

  • Typosquats — NRD entries flagged as typosquats with their best-match brand and distance.

Commands used

dmontip-get-nrd

Flowchart

yes Start Start Fetch newly registered domains - dmontip-get-nrd Fetch newly registered do... dmontip-get-nrd Score each NRD against the brand list - DarkmonScoreNRDs Score each NRD against th... DarkmonScoreNRDs Filter unseen typosquats - DarkmonFilterUnseen Filter unseen typosquats DarkmonFilterUnseen Open typosquatting incidents - DarkmonCreateIncidents Open typosquatting incidents DarkmonCreateIncidents Notify brand-protection team - Darkmon - Generic Notify Notify brand-protection team Darkmon - Generic Notify Done Done Is Darkmon integration available? - IsIntegrationAvailable Is Darkmon integration av... IsIntegrationAvailable Done Done

Source

playbook-Darkmon_Brand_Targeted_NRD_Watch.yml
Download History Raw 
id: Darkmon - Brand-Targeted NRD Watch
version: -1
name: Darkmon - Brand-Targeted NRD Watch
description: Daily sweep of newly-registered domains. Each candidate's root label is compared against the brand list via DarkmonLevenshtein; matches with distance <= 2 (configurable) open a 'Darkmon Typosquatting Threat' incident.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
- brand-protection
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: f693a6e5-6455-417e-889c-78b3b4551f14
    type: start
    task:
      id: f693a6e5-6455-417e-889c-78b3b4551f14
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: bc24ded0-f848-4b88-8f87-dbb5be4e678c
    type: regular
    task:
      id: bc24ded0-f848-4b88-8f87-dbb5be4e678c
      version: -1
      name: Fetch newly registered domains
      description: ''
      script: Darkmon|||dmontip-get-nrd
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      size:
        simple: '200'
      sort:
        simple: timestamp,desc
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: 2814ff2c-9986-4dd8-90d3-4da9877075ee
    type: regular
    task:
      id: 2814ff2c-9986-4dd8-90d3-4da9877075ee
      version: -1
      name: Score each NRD against the brand list
      description: Helper script that loops over NRDs and calls DarkmonLevenshtein per (domain, brands) pair. Returns ${{Typosquats}} for entries with distance <= max_distance.
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonScoreNRDs
    scriptarguments:
      domains:
        simple: ${{Darkmon.NRD}}
      brands_list:
        simple: Darkmon - Brand Names
      max_distance:
        simple: ${inputs.MaxDistance}
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 723722dd-6c55-4a63-8ad7-793b89dc2dd7
    type: regular
    task:
      id: 723722dd-6c55-4a63-8ad7-793b89dc2dd7
      version: -1
      name: Filter unseen typosquats
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterUnseen
    scriptarguments:
      items:
        simple: ${{Typosquats}}
      id_field:
        simple: id
      seen_list:
        simple: Darkmon - Seen NRDs
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: b0f55cfe-1bb2-4d0f-b6f5-34a617c0626c
    type: regular
    task:
      id: b0f55cfe-1bb2-4d0f-b6f5-34a617c0626c
      version: -1
      name: Open typosquatting incidents
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Typosquatting Threat
      name_template:
        simple: 'Darkmon: ${{value}} resembles ${{brand}} (d=${{distance}})'
      field_map:
        simple: darkmonobserveddomain=value,darkmonbrand=brand,darkmondistance=distance,darkmonregisteredat=timestamp
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: 39a521cc-5290-4e1e-9ad1-547bd592023c
    type: playbook
    task:
      id: 39a521cc-5290-4e1e-9ad1-547bd592023c
      version: -1
      name: Notify brand-protection team
      description: ''
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic Notify
    scriptarguments:
      Subject:
        simple: 'Darkmon: typosquatting candidates'
      Body:
        simple: Created ${{NewAccounts.length}} typosquatting incidents.
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '6':
    id: '6'
    taskid: 3c52853d-c538-4a4c-9b37-5af3bf40393e
    type: title
    task:
      id: 3c52853d-c538-4a4c-9b37-5af3bf40393e
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: fe0a47b7-3893-4934-bd6c-5dba166c9000
    type: condition
    task:
      id: fe0a47b7-3893-4934-bd6c-5dba166c9000
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: b5c89fd3-d44d-4b4d-80a8-5aaf1c29e87d
    type: title
    task:
      id: b5c89fd3-d44d-4b4d-80a8-5aaf1c29e87d
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1895, "width": 980, "x": -500, "y": 0}}}'
inputs:
- key: MaxDistance
  value:
    simple: '2'
  required: false
  description: Maximum Levenshtein distance between a newly registered domain root label and any brand in the Darkmon - Brand Names list for the NRD to be flagged as a typosquatting candidate. Defaults to 2. Lower (1) for stricter brand-protection, raise (3) for broader recall.
  playbookInputQuery:
outputs:
- contextPath: Typosquats
  description: NRD entries flagged as typosquats with their best-match brand and distance.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security