Give Threat Actors a Dose of Their Own Medicine

The medical community emphasizes preventative care to detect or prevent illness and serious diseases before they become critical. That same principle can be leveraged in the defender community working to prevent ransomware, phishing, or the manipulation of prescriptions in electronic healthcare records (EHRs). Defenders who learn all they can about adversary infrastructure including domains or IP addresses can thwart an attack before it’s too late. 

In this live presentation, Malachi Walker (Security Advisor at DomainTools) and Yelisey Bohuslavskiy (Chief Research Officer at RedSense) will equip the audience with context regarding the state of ransomware within the healthcare industry along with discoveries and methodologies from the DomainTools research team in phishing, malware, and spam that impact information security professionals. 

You’ll leave this discussion with an understanding of how: 

• Domain spoofing research is working to prevent ransomware
• Techniques such as analysis of passive DNS and domain registration records can support investigations 
• DNS can be used to draw connections between malicious domains and predict moves by adversaries

The post Vital Signs: Using DNS to Predict Adversary Moves in Healthcare appeared first on DomainTools | Start Here. Know Now..

Proactively Uncover Threats Using DNS and Data Science

Threat actors register and weaponize domains every day as part of phishing, malware, and spam campaigns. The goal of network defense is to identify and flag these domains registered with “malicious intent” before they are weaponized. Such advanced detection and categorization have many applications, including perimeter or host defenses, on-network threat discovery, or forensic review.

Join VP of Research and Data, Sean McNee, Ph.D, and Senior Data Engineer, Aaron Gee-Clough as they demonstrate how the DomainTools Domain Risk Score can be used to augment an organization’s existing threat intelligence processes. 

You’ll leave this presentation with an understanding of: 

• What the domain risk scores are, and what they mean for defenders
• How the scores work and how they’re generated at a high level
• What defenders can do with risk scores including monitoring, alerting, and triaging workflows

The post Malicious Intent and You: A Primer on DomainTools Risk Scoring appeared first on DomainTools | Start Here. Know Now..

DomainTools Contribution to the Fulfillment of the Zero Trust Objective 

The concept of Zero Trust is something those in our industry are increasingly hearing, whether because of regulatory guidelines, CISO, guidance, or both. The US Federal/Government agencies have previously entrusted DomainTools for Internet intelligence, and it can play an important role in such initiatives, as connections from the protected environment to unknown (and therefore untrusted) infrastructure represent a genuine and pervasive risk. 

Join us for a live demonstration to show how we help security teams in the government space: 

• Identify and/or block connections to newly-created domains
• Build context around adversary-controlled infrastructure
• Identify clusters of malicious activity based infrastructure patterns
• Monitor emerging attack campaigns as the adversary develops them

The post Protecting Your Environment From the Unknown: Zero Trust and DomainTools appeared first on DomainTools | Start Here. Know Now..

New Features Improve Detection and Response to Malicious Infrastructure

Tens of thousands of domains are registered on the Internet daily for phishing, command and control (C2), data exfiltration, and other illicit activity. Incident response teams, threat intelligence managers, and SOC managers need a complete picture of the infrastructure associated with a threat in order to stop the next attack from the same actor. 

Using Iris Investigate, threat hunters, incident responders, and other SOC personnel can quickly identify malicious infrastructure and mine 20+ years of Whois records to make connections and track threat actors’ campaign evolutions, and assess potential risks.  

Join Tim Helming and Grant Cole for a live demonstration of Iris Investigate so you can elevate your security operations and get to the data that matters most. Our presenters will cover: 

• Domain History: See how a domain evolves over time. You can trace when a domain potentially becomes malicious by tracing who controlled it, where it was hosted, what web content it provided and more.
• Enhanced Certificates: Faster gathering of certificates and more powerful queries against certificate data
• More Web Trackers: We are gathering new web trackers to improve the overall breadth and depth of web content that we capture, making it easier to find malicious actors recycling webpages across domains. 
• Additional enhancements in passive DNS, IP Profile data, user-triggered Whois record updates, and more.

The post Give Bad Actors More Bad Days: New Enhancements to Iris Investigate appeared first on DomainTools | Start Here. Know Now..

What Malicious Tactics Might Reign Supreme in 2024?

While it’s not possible to predict the future, what we can do is look at the trends and data we have from malicious actors to make inferences on what could occur in the future to maintain a proactive and defensive stance. 

Join subject matter experts from DomainTools for a lively discussion on what to expect in the coming year. VP of Research and Data Sean McNee, CISO Daniel Schwalbe, and Security Evangelist Tim Helming will conduct a roundtable discussion on their information security predictions. Highlights include:

• Discussion from last year’s predictions: what came to fruition and what didn’t
• The continued growth and ubiquity of ChatGPT/LLMs
• The 2024 election and possible USPS smishing campaigns and disinformation
• Possible supply chain breakdowns surrounding the Ukraine/Russia war
• Deep fakes and the potential impact on international diplomacy 

The post DomainTools 2024 Infosecurity Forecast appeared first on DomainTools | Start Here. Know Now..

Updates and Enhancements to the DomainTools App for Cortex XSOAR

With the DomainTools App for Cortex XSOAR, security teams can automate the incident response process with expanded Internet infrastructure data to reduce reaction time spent triaging incoming malicious traffic. New capabilities enable proactive monitoring for suspicious infrastructure targeting your organization, enabling you to stay ahead of threat actors, reducing your overall risk exposure. 

The latest updates and enhancements to the DomainTools App for Cortex XSOAR represent our most significant update to the new app in years, including new commands, expanded result sets, and playbooks enabling users to better automate and streamline their threat hunting processes and incident response capabilities. In this upcoming live demonstration, VP of Product, Dan Nunes and Security Evangelist Tim Helming will share how users can: 

• Automatically enrich hundreds of indicators with DomainTools data and risk scoring
• Discover connected infrastructure of interest
• Proactively stay ahead of new infrastructure, identifying new related domains within moments of their creation

The post Instant Infrastructure Intel appeared first on DomainTools | Start Here. Know Now..

The significance of the retail sector is diverse and enormous. Many sectors including shipping and transportation, technology, manufacturing, finance, commercial real estate, and so many others benefit from the flow of goods and services retail generates. 

Given the volumes of goods and services and their monetary value, the retail sector is no stranger to the subjects of fraud, theft, and other types of crime. This presentation will highlight several ways that actors seek to take advantage of this growing landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves. As such, we will dig into three different “clusters” affecting the retail sector.

In this on-demand presentation, Daniel Schwalbe and Sasha Angus will discuss: 

• The three findings of recent research including e-commerce domain fraud, brand impersonation, and ponzi schemes
• How infrastructure pivots can help to enumerate these clusters 
• How the retail sector can protect their organization and customers

The post Domain Fraud Brand Impersonation and Ponzi Schemes appeared first on DomainTools | Start Here. Know Now..

The significance of the retail sector is diverse and enormous. Many sectors including shipping and transportation, technology, manufacturing, finance, commercial real estate, and so many others benefit from the flow of goods and services retail generates. 

Given the volumes of goods and services and their monetary value, the retail sector is no stranger to the subjects of fraud, theft, and other types of crime. This presentation will highlight several ways that actors seek to take advantage of this growing landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves. As such, we will dig into three different “clusters” affecting the retail sector.

In this on-demand presentation, Daniel Schwalbe and Sasha Angus will discuss: 

• The three findings of recent research including e-commerce domain fraud, brand impersonation, and ponzi schemes
• How infrastructure pivots can help to enumerate these clusters 
• How the retail sector can protect their organization and customers

The post Unlock the Power of Predictive Risk Scoring and Domain Discovery with the DomainTools OEM Program appeared first on DomainTools | Start Here. Know Now..