0

I'm quite new to the security field and learning my ways on how to triage certain events.

One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if that device is compromised, I'm not too sure what else to do to confirm if it was.

When I investigate the event, it gives me the URL which is http://vap1ord1.lijit.com/

To triage, I do the below:

  1. Go to virustotal (or other sites) and verify if the URL is indeed malicious
  2. Check the device (user laptop) in question and run a scan with the anti virus software
  3. Verify that there are no active communication between the device and the phishing website

Aside from performing the above steps to triage, are there any other steps I can perform to ensure that the device is indeed not compromised?

  • You are missing some context to the situation. Where are the alerts coming from (perimeter or the endpoint device or somewhere else)? Were the emails opened? Were the links clicked? No sense triaging for a gunshot wound if the gun missed. – schroeder Feb 19 at 15:34
  • The tool monitors all devices connected to the network. In this case, the alert was generated from a laptop. It has been found to go to the malicious URL mentioned above and is the reason it triggered. The tool also detailed out the Destination IP of the bad URL. However, what I'm asking is, if the user of the device so happened to click on the link and/or opened the attachment, what are additional steps you can take aside from the above I mentioned. Just as a baseline for me since I'm in the learning phase and I can expand on that. – Aspire27 Feb 19 at 16:48
2

There are 2 main things to look for:

  • known indications of compromise
  • anomalies that would be indicators of compromise

By going to VirusTotal and running antivirus scans, you are looking for known indications of compromise.

Looking for traffic back to the site is in the realm of looking for anomalies, but it is not very helpful. A phishing URL may exist for only a few hours. Phishers know that their URL get blocked pretty quickly, so they plan for it. when the device is compromised, they would direct the device to contact their more permanent command and control server. So, what you would want to look for is anomalous traffic from the device. Your ability to gather and classify data as anomalous will depend on your toolsets.

You also want to look for anomalies on the device itself, like new accounts, new running processes, changed binaries, opened ports, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.