Splunk unknown experimental spl

Monitor Web Traffic For Brand Abuse

The following analytic identifies web requests to domains that closely resemble your monitored brand's domain, indicating potential brand abuse. It leverages data from web traffic sources, such as web proxies or network traffic analysis tools, and cross-references these with known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or other malicious activities targeting your brand. If confirmed malicious, attackers could deceive users, steal credentials, or distribute malware, leading to significant reputational and financial damage.

View Source

Detection Logic

| tstats `security_content_summariesonly`
  values(Web.url) as urls
  min(_time) as firstTime
  from datamodel=Web
  by Web.src
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse
| search domain_abuse=true
| `monitor_web_traffic_for_brand_abuse_filter`

False Positives

  • No false positives have been identified at this time.

Field Validations

Loading…

Comments (0)

Loading comments...