Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.
Many cyberattacks begin by victims visiting compromised websites that host malware or phishing scams, threat actors use domains for different malicious purposes as part of their infrastructure, and malware communicates with external sites for command and control and exfiltration.
Detecting suspicious domains and preemptively feeding corporate security systems can disrupt attacks before they happen, with VT Intelligence being the perfect platform to early detect them and monitor malicious campaigns' evolution.
Let's start by searching for domains that use self-signed certificates.
The use of these certificates raise some suspicion as they are unverified.
This means anyone can create and issue a certificate for any domain, making it easier for malicious actors to impersonate legitimate websites.
We will look for domains created no more than a week ago according to their whois information.
Finally, we want samples with more than 5 detections to avoid false positives, however this is completely at your discretion.
Entity:domain tag:self-signed creation date:7d+ p:5+.
Moving to the next stage, let's look for C2 domains.
Malware periodically contacts C2 servers to receive instructions, that's why it is worth investigating any connection to them originating from our network.
We will use modifier to look for domains updated in VT for the last week and modifier to search for domains with at least 20 files in VirusTotal that have been observed trying to contact the domain during sandbox detonation.
Finally, we will hunt typosquatted domains to impersonate a given legitimate one, in this example we will use Fedex.
The domain modifier searches for domains containing this word as a substring, and the depth modifier specifies how many subdomains to include in the search.
We narrow down the results to domains with at least 5 detections to reduce noise from false positives.
You can learn more about domain search modifiers in the documentation.
This Cyber News was published on blog.virustotal.com. Publication date: Mon, 25 Dec 2023 11:43:06 +0000