Press ESC to close

Protecting the perimeter with VT Intelligence – malicious URLs

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.
One of the main attacking vectors attackers use for credential theft and malware deployment are malicious link-based attacks leveraging impersonated websites or distributing malware. By studying malicious campaigns, defenders can learn attacker tactics and refine their defensive arsenal. They can also use suspicious URLs preemptively, updating deny lists and searching for any suspicious internal or perimetral activity.
VT Intelligence provides a powerful toolset for this mission and can be used to improve URL filtering in your firewalls. Now, we will dive into a series of VT queries progressively increasing their complexity, and dissect the added modifiers for each step. Feel free to experiment and refine these examples to build your own customized queries.

To begin, we will start by searching for URLs (“entity:url”) categorized as phishing according to the content category of its domain (“category:phishing”) or labeled as phishing by AntiVirus engines (“engines:phishing”). We will use the “p” modifier (“p” is short for “positives”, referring to the number of engines detections) to discard benign URLs. In this case, we want URLs with more than 15 detections to avoid false positives, however this is completely at your discretion. Finally, we will look for URLs first seen (“fs” as short for first submission) in the last 7 days (7d+).
entity:url (category:phishing or engines:phishing) p:15+ fs:7d+

The following query hunts new malicious URLs submitted to VirusTotal in the last 7 days distributing Microsoft document or PDF files (“tag:downloads-doc or tag:downloads-pdf”). We use the “p” modifier to search for URLs with a high number of detections (“p:15+”). Malicious URLs used for phishing are likely to distribute this kind of files to compromise the victim’s system.
entity:url (tag:downloads-doc or tag:downloads-pdf) p:15+ fs:7d+

Finally, we will hunt URLs impersonating a corporate service provider, such as Office365. We will use the “url” modifier to match substrings contained in the URL string (“url:office365”). In this scenario, we want to find URLs used by attackers to impersonate Office 365 built using WordPress (“path:wp-content”), and filter the ones with at least 5 detections (“p:5+”). This kind of malicious URLs impersonate legitimate service providers and commonly redirect users to another location after providing their credentials, typically the legitimate site to avoid suspicion. We will check for this behaviour with the “have:redirects_to” modifier.
entity:url url:office365 have:redirects_to path:wp-content p:5+

You can learn more about URL search modifiers in the documentation.
As always, we would like to hear from you.
Happy hunting!

.my-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: Black;
color: White;
/*padding: 24px;*/
border-collapse: collapse;
}

.my-yara-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: #F7F9F9;
color: Black;
/*padding: 24px;*/
border-collapse: collapse;
text-align: center;
}

mark.green {
color:#3cb371;
background: none;
}
mark.gray {
color:Gray;
background: none;
}
mark.yellow {
color:Yellow;
background: none;
}
mark.orange {
color:Orange;
background: none;
}
mark.red {
color:Red;
background: none;
}
mark.blue {
color:#33BEFF;
background: none;
}

mark.dark-blue {
color:Blue;
background: none;
}
.table-container {
/*padding: 32px;*/
font-family: “Courier”, sans-serif;
font-size: medium;
}

.table-container table {
width: 100%;
background: #fff;
color: #222;
/*padding: 24px;*/
border-collapse: collapse;
}

.table-container table th {
font-weight: bold!important;
text-transform: none!important;
}

th:first-child { width: 24%; }
th:first-child+th { width: 39%; }

/*
.table-container table td,
.table-container table th {
padding: 16px 32px;
}
*/

.table-container table tr {
border-bottom: 1px solid #eee;
}

@media (max-width: 580px) {
.table-container table thead {
display: none;
}

.table-container table td {
display: block;
}

}

a {
color: blue!important;
}

.central_img {
position: relative;
display: block;
margin-left: auto;
margin-right: auto;
}

.central_img img {
border: 1px solid #000000;
}

.central_img p {
text-align: center;
font-style: italic;
}

.width_10 {
width: 10%;
}

.width_15 {
width: 15%;
}

.width_20 {
width: 20%;
}

.width_30 {
width: 30%;
}

.width_40 {
width: 40%;
}

.width_50 {
width: 50%;
}

.width_60 {
width: 60%;
}

.width_80 {
width: 80%;
}

.width_90 {
width: 90%;
}

.width_100 {
width: 100%;
}

ul{
margin-bottom: 5px!important;
}

.interval_12{
margin-bottom: 12px!important;
}

Source: VirusTotal

Published on: December 18, 2023

Related posts:

Analyzing a Malicious Advanced IP Scanner Google Ad Redirection | Huntress Combating Emerging Microsoft 365 Tradecraft: Initial Access | Huntress SelectBlinds says 200,000 customers impacted after hackers embed malware on site Burning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPs

Leave a Reply

Your email address will not be published. Required fields are marked *

Stay Updated with Our Newsletter

Filter Posts by Date

Explore Topics