Triaging malicious URLs

Question

I'm quite new to the security field and learning my ways on how to triage certain events.

One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if that device is compromised, I'm not too sure what else to do to confirm if it was.

When I investigate the event, it gives me the URL which is http://vap1ord1.lijit.com/

To triage, I do the below:

1. Go to virustotal (or other sites) and verify if the URL is indeed malicious
2. Check the device (user laptop) in question and run a scan with the anti virus software
3. Verify that there are no active communication between the device and the phishing website

Aside from performing the above steps to triage, are there any other steps I can perform to ensure that the device is indeed not compromised?

Answer 1

There are 2 main things to look for:

• known indications of compromise
• anomalies that would be indicators of compromise

By going to VirusTotal and running antivirus scans, you are looking for known indications of compromise.

Looking for traffic back to the site is in the realm of looking for anomalies, but it is not very helpful. A phishing URL may exist for only a few hours. Phishers know that their URL get blocked pretty quickly, so they plan for it. when the device is compromised, they would direct the device to contact their more permanent command and control server. So, what you would want to look for is anomalous traffic from the device. Your ability to gather and classify data as anomalous will depend on your toolsets.

You also want to look for anomalies on the device itself, like new accounts, new running processes, changed binaries, opened ports, etc.