Suspicious Domain Hunting Incident Handling

This playbook process "Suspicious Domain Hunting" incidents generated by the CertStream integration.

Suspicious Domain Hunting · 32 tasks · 3 inputs · 0 outputs

Inputs

  • similarityMaxThreshold — The minimum threshold value for malicious verdict
  • similarityMinThreshold — The minimum threshold value for suspicious verdict
  • contactEmail — Email address to be used as contact email when sending a takedown request email

Commands used

closeInvestigation domain expireIndicators rasterize setIndicators url whois

Flowchart

#error# #error# Benign Malicious yes yes Malicious Suspicious Start Start Check Reputation on the Domain - domain Check Reputation on the D... domain Rasterize Suspicious Webpage - rasterize Rasterize Suspicious Webpage rasterize Handle True Positive Handle True Positive Block Domain - Generic v2 - Block Domain - Generic v2 Block Domain - Generic v2 Block Domain - Generic v2 Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Done Done Get the suspicious HTMLcontent - HttpV2 Get the suspicious HTMLco... HttpV2 Check the Reputation of the URL - url Check the Reputation of t... url Set the certificate's verdict to malicious - setIndicators Set the certificate's ver... setIndicators Set the Domain's verdict to malicious - setIndicators Set the Domain's verdict ... setIndicators Get original HTML content - HttpV2 Get original HTML content HttpV2 Calculate Diff of Website Content - HtmlDifflibCheck Calculate Diff of Website... HtmlDifflibCheck Whois - Domain - whois Whois - Domain whois Analyst desicion Analyst desicion Close this Investigation as Benign - closeInvestigation Close this Investigation ... closeInvestigation Compare Images - imagecompare Compare Images imagecompare Analysis Analysis Rasterize Original Webpage - rasterize Rasterize Original Webpage rasterize Is whois Integration Available? - IsIntegrationAvailable Is whois Integration Avai... IsIntegrationAvailable Benign Benign Set closing reason as Benign - Set Set closing reason as Benign Set Set Verdict to Context - Set Set Verdict to Context Set Malicious Malicious Expire certificate indicator - expireIndicators Expire certificate indicator expireIndicators Does the http request body exist? Does the http request bod... Rasterize & Compare Webpage Image Rasterize & Compare Webpa... Compare HTML Content using Diff Compare HTML Content usin... Verdict Verdict Suspicious Suspicious Check if a malicious Domain was identified Check if a malicious Doma... Set Contact Email to context - SetAndHandleEmpty Set Contact Email to context SetAndHandleEmpty