URL

Overview

For URL indicators, the CoreTIS platform provides specialized modules within the “Detection” and “Details” tabs. Each module is designed to extract and analyze different aspects of the URL, aiding in cybersecurity assessments and threat response.

Detection Tab for URL Indicators

1. Antivirus Engine Analysis

Evaluates the URL against multiple antivirus engines to determine if it is safe or malicious.

• Data Provided:
  • Results from each antivirus engine, categorizing the URL as malicious, suspicious, harmless, or undetected.
• Utility:
  • Offers a quick and diverse assessment of the URL’s safety from multiple trusted sources.
  • Helps to flag dangerous URLs and prevent access to potentially harmful web resources.

2. User Report Analysis

Contains reports from users about their interactions or observations regarding the URL.

• Data Provided:
  • The number of times the URL has been reported and the associated level of abuse confidence.
• Utility:
  • Reflects the URL’s reputation within the CoreTIS user community.
  • Assists in recognizing emergent threats that may not yet be widely known.

3. Open Threat Exchange Analysis

Incorporates threat intelligence data related to the URL from shared community resources.

• Data Provided:
  • Information about malware, DNS queries, and other threat indicators linked to the URL.
• Utility:
  • Provides context on the URL’s history and connections to known threats.
  • Enhances situational awareness and aids in proactive defense strategies.

4. URL Behaviour Analysis (using urlscan.io)

Analyzes the behavior of the URL by simulating its opening in a controlled environment.

• Data Provided:
  • Data from urlscan.io, detailing the URL’s behavior, related domains, IP addresses, and other associated entities.
• Utility:
  • Reveals the URL’s actions when accessed, such as redirections, downloads, or script executions.
  • Identifies associated entities that could be part of a malicious infrastructure.

Details Tab for URL Indicators

1. SSL Certificate

Displays information about the SSL certificate of the URL to assess the security of the connection.

• Data Provided:
  • Details on the SSL certificate, including the issuing authority, validity dates, and encryption specifics.
• Utility:
  • Validates that the URL provides a secure, encrypted connection.
  • Helps to detect potentially compromised or fake websites.

Best Practices for Analysts

• Combine insights from all modules to develop a thorough understanding of the URL’s risk profile.
• Act on the information provided by the Antivirus Engine Analysis to block or restrict access to URLs deemed unsafe.
• Monitor user reports and Open Threat Exchange data for new or evolving threats associated with the URL.
• Utilize URL Behaviour Analysis to understand the potential actions that could be carried out by visiting the URL.