adam's notes

IP and Domain Threat Intel

Domain Enrichment

A/AAAA Records

  • map the domain to IPv4 and IPv6 addresses
  • investigate the resolved IP and see if:
    • it is tied to a known APT infrastructure
    • or maps to a known attack campaign

TXT Records

  • can tell a lot about the domain: from its mail security settings (SPF/DKIM) to the tools it uses
  • an attack on infrastructure will generally have:
    • empty TXT records
    • or point you to some interesting discoveries
      • e.g., suspicious SPF records or a faked DKIM signature

WHOIS / RDAP

  • reveals registrar, registration, and expiry dates, and, most importantly, the domain’s age
    • attack infrastructure rarely stays online for more than a few months
    • Malicious domains, by contrast, often live for only a few days

IP Enrichment

  • query the IP address in two services:
    • AbuseIPDB
      • see if the IP was involved in any port scans or brute-force attacks
  • VirusTotal
    • get the overall IP reputation and read its community comments (if any)
    • if the IP is not within the CDN range, even 1 detection is an indicator of a risky IP

Autonomous Systems

An Autonomous System (AS) is a collection of IP prefixes under a single organization’s control.

  • Each AS is assigned a unique number (ASN)
  • BGP.Tools gives the most comprehensive info about the AS and its purpose
  • assess the likely role of an IP:
    • Residential ASNs
      • Alerts on these may indicate VPN usage or compromised consumer devices
      • e.g., AS124888 (Vodafone)
    • Server Hostings
      • most risky role
      • often used by adversaries to distribute malware
      • e.g., AS215439 (PLAY2GO)
    • Cloud/CDN ASNs
      • Used by both legitimate services and adversaries
      • needs deeper analysis
      • e.g., AS16509 (Amazon AWS)

Geolocation (GeoIP)

  • useful during the investigation of anomalous logons
  • Tools:
  • helps you with:
    • User logon analysis
      • e.g., If a US-based employee logs on from the Netherlands, it might indicate an intrusion
    • Network analysis
      • e.g., If you monitor a local European company, any traffic to Vietnam is suspicious

Service Exposure

  • Knowing what services are exposed on an IP is useful
    • helps figure out how the attacker got in
    • helps identify potential vectors of compromise

Shodan Reconnaissance

Shodan provides detailed information about open ports, running services, and system configurations by indexing internet-connected devices and services.

  • can extract information on:
    • Open Ports
      • This is the first fingerprint of exposure
    • Service Banners
      • provide hints on service versions
      • An old version usually means a vulnerable version
  • Shodan

Censys shows exposed services even on non-standard ports and provides some advanced search capabilities.

TLS Certificates

  • IPs that expose HTTPS services bring in a new interesting indicator: TLS certificates
  • use tools such as crt.sh to look at TLS certificate information as a gold mine for enrichment
    • often unavailable due to high request volume
  • investigate the certificates with Censys or SSL Shopper
    • key fields to look for:
      • Issuer
        • A self-signed certificate is a strong indicator that the website is worth investigating
      • Validity
        • Newly-created and long-lived certificates can also indicate malware infrastructure
      • Subject
        • For self-certificates, this can point to a program behind the HTTPS (e.g., Pfsense)

VPN Detection

  • Tools essential resources for labeling VPN, proxy, and Tor exit nodes:
  • e.g., known VPN node means you can’t trust the geolocation of users behind it

SOC Analyst Workflow

  1. Investigate the domain
    • Does it “look” legit? Does it remind you of typosquatting?
    • What is its reputation? Is it a known malicious domain?
    • When was it registered? If it’s new, that’s suspicious.
    • Resolve the domain to IP and investigate the IP.
  2. Investigate the IP
    • Is it a CDN range? If yes, no need to investigate further.
    • What is its reputation? Use VirusTotal, AbuseIPDB, etc.
    • Where is it located? Is it a VPN node? How does it match the alert?
      (Example: US-based user is not expected to log in from Asia)
    • What AS type does it belong to? How does it match the alert?
      (Example: employees are not expected to log in from cloud hosting)

Reference

IP and Domain Threat Intel. (2023). TryHackMe. https://tryhackme.com/room/ipanddomainthreatintel

Graph View

Backlinks