DBotPredictURLPhishing

Details

ID	`DBotPredictURLPhishing`
Language	python
From Version	6.0.0
Docker Image	`demisto/mlurlphishing:1.0.0.8936013`
Tags	ml

README

Predict phishing URLs using a pre-trained model.

Security Recommendations

This script uses the Rasterize integration. If this script is used to rasterize untrusted URLs, we strongly recommend following the security recommendations included at the Rasterize Documentation.

Script Data

Name	Description
Script Type	python3
Tags	ml
Cortex XSOAR Version	6.0.0

Used In

This script is used in the following playbooks and scripts.

Phishing - Machine Learning Analysis

Inputs

Argument Name	Description
urls	Space-separated list of URLs.
emailBody	Body of the email for URL extraction.
emailHTML	HTML of the email for URL extraction.
maxNumberOfURL	Maximum number of extracted URLs on which to run the model.
forceModel	Whether to force the model to run if the URL belongs to the whitelist. If True, the model will run in every case. If False, the model will run only if the URL does not belong to the whitelist.
resetModel	Whether to reset the model to the model existing in Docker.
defaultRequestProtocol	The protocol to use when calling the URLs. This argument effects the calls sent by the model only and has no effect on the rasterize or whois commands.
debug	Whether to enter debug mode.
reliability	Reliability of the source providing the intelligence data.

Outputs

Path	Description	Type
DBotPredictURLPhishing.URL	URL on which the model ran.	String
DBotPredictURLPhishing.FinalVerdict	Final verdict of the URL.	String
DBotPredictURLPhishing.UseOfSuspiciousLogo	Whether a logo (from our list of top most use company for phishing) has been fraudulently used. Our predefined list of logos is: Paypal, Instagram, Gmail, Outlook, Linkedin, Facebook, Ebay, amazon, Google, Microsoft.	String
DBotPredictURLPhishing.HasLoginForm	Whether there is a login form in the HTML. Usually phishing attacks aim to steal credentials from the victim and attackers using login forms to retrieve this information.	String
DBotPredictURLPhishing.URLStaticScore	Probability for the URL to be malicious based only on the URL syntax.	Number
DBotPredictURLPhishing.BadSEOQuality	Whether the domain has a good search engine optimization. Malicious domains tend to have a poor SEO.	String
DBotPredictURLPhishing.NewDomain	Whether the domain is younger than 6 months. New domains tend to be malicious.	String
DBotPredictURLPhishing.TopMajesticDomain	Whether the domain belongs to the top Majestic domain list. If it does, we will always consider this domain as benign.	String
DBotScore.Score	Severity score.	Number

Script Examples

Example command

!DBotPredictURLPhishing urls="http://google.com"

Context Example

{
  "DBotPredictURLPhishing": [
    {
      "FinalVerdict": "Benign",
      "TopMajesticDomain": "True",
      "URL": "http://google.com"
    }
  ]
}

Human Readable Output

Phishing prediction summary for URLs

URL Final Verdict

http://google.com Benign - whitelisted

URL	Final Verdict
http://google.com	Benign - whitelisted

Source

DBotPredictURLPhishing.py DBotPredictURLPhishing_test.py DBotPredictURLPhishing.yml

Download History Raw

args:
- description: Space-separated list of URLs.
  isArray: true
  name: urls
- description: Body of the email for URL extraction.
  name: emailBody
- description: HTML of the email for URL extraction.
  name: emailHTML
- defaultValue: '3'
  description: Maximum number of extracted URLs on which to run the model.
  name: maxNumberOfURL
- defaultValue: '120'
  description: The timeout of the rasterize module in seconds.
  name: rasterize_timeout
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to force the model to run if the URL belongs to the whitelist. If True, the model will run in every case. If False, the model will run only if the URL does not belong to the whitelist.
  name: forceModel
  predefined:
  - 'True'
  - 'False'
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to reset the model to the model existing in Docker.
  name: resetModel
  predefined:
  - 'False'
  - 'True'
- description: The protocol to use when calling the URLs. This argument effects the calls sent by the model only and has no effect on the rasterize or whois commands.
  defaultValue: 'HTTP'
  name: defaultRequestProtocol
  auto: PREDEFINED
  predefined:
  - 'HTTP'
  - 'HTTPS'
- auto: PREDEFINED
  description: Whether to enter debug mode.
  defaultValue: 'False'
  name: debug
  predefined:
  - 'False'
  - 'True'
- auto: PREDEFINED
  description: Reliability of the source providing the intelligence data.
  defaultValue: A+ - 3rd party enrichment
  name: reliability
  predefined:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
comment: Predict phishing URLs using a pre-trained model.
commonfields:
  id: DBotPredictURLPhishing
  version: -1
enabled: true
name: DBotPredictURLPhishing
outputs:
- contextPath: DBotPredictURLPhishing.URL
  description: URL on which the model ran.
  type: String
- contextPath: DBotPredictURLPhishing.FinalVerdict
  description: Final verdict of the URL.
  type: String
- contextPath: DBotPredictURLPhishing.UseOfSuspiciousLogo
  description: 'Whether a logo (from our list of top most use company for phishing) has been fraudulently used. Our predefined list of logos is: Paypal, Instagram, Gmail, Outlook, Linkedin, Facebook, Ebay, amazon, Google, Microsoft.'
  type: String
- contextPath: DBotPredictURLPhishing.HasLoginForm
  description: Whether there is a login form in the HTML. Usually phishing attacks aim to steal credentials from the victim and attackers using login forms to retrieve this information.
  type: String
- contextPath: DBotPredictURLPhishing.URLStaticScore
  description: Probability for the URL to be malicious based only on the URL syntax.
  type: Number
- contextPath: DBotPredictURLPhishing.BadSEOQuality
  description: Whether the domain has a good search engine optimization. Malicious domains tend to have a poor SEO.
  type: String
- contextPath: DBotPredictURLPhishing.NewDomain
  description: Whether the domain is younger than 6 months. New domains tend to be malicious.
  type: String
- contextPath: DBotPredictURLPhishing.TopMajesticDomain
  description: Whether the domain belongs to the top Majestic domain list. If it does, we will always consider this domain as benign.
  type: String
- contextPath: DBotScore.Score
  description: Severity score.
  type: Number
script: '-'
subtype: python3
tags:
- ml
timeout: 480ns
type: python
dockerimage: demisto/mlurlphishing:1.0.0.8936013
runas: DBotRole
tests:
- DBotPredictURLPhishing_test
fromversion: 6.0.0