Prodaft USTA

Overview

USTA is a market-leading threat intelligence solution provided by PRODAFT specifically designed to combat ransomware, online fraud, and account takeover attempts.

Vendor: PRODAFT
Supported product: USTA - Account Takeover Prevention
Supported data source: USTA Compromised credentials feed
Supported environment: Cloud / SaaS
Detection based on: External credential compromise intelligence

This integration enables the ingestion of compromised credential feeds generated by the USTA Account Takeover module into Sekoia.io.

The feed provides indicators related to exposed or compromised user accounts, allowing SOC teams to correlate external credential compromise signals with authentication activity, detect account takeover attempts, and prioritize remediation actions.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Detection

Collecting compromised credential events from USTA enables several security detection and investigation use cases within Sekoia.io.

Example use cases

Detection of internal authentication attempts involving externally compromised accounts.
Prioritization of account remediation based on risk details provided.
Correlation with IAM, VPN, or SaaS authentication logs to identify potential account takeover activity.
Threat hunting on users exposed in recent credential leaks.

Configure

Prerequisites

Before configuring the integration, ensure that you have:

Access to the USTA platform.
Access to the Company - Integrations module (admin privilege or special permissions might be required).
The required credentials to retrieve the compromised credentials feed (API token).
A Sekoia.io account with permissions to create and manage intakes.

Create USTA credentials

Log in to the USTA platform.
Navigate to the Management -> Company Settings -> Integrations -> API keys.
Locate your API token and copy it.
Save these credentials for use in Sekoia.io.

Instruction on Sekoia

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

test_usta_atp_incident

{
    "company": {
        "id": 0,
        "name": "string"
    },
    "content": {
        "is_corporate": true,
        "password": "string",
        "password_complexity": {
            "contains": {
                "lowercase": 0,
                "numbers": 0,
                "other": 0,
                "punctuation": 0,
                "separators": 0,
                "symbols": 0,
                "uppercase": 0
            },
            "length": 0,
            "score": "very_weak"
        },
        "source": "malware",
        "url": "http://example.com",
        "username": "username",
        "victim_detail": {
            "computer_name": "string",
            "country": "string",
            "cpu": "string",
            "gpu": "string",
            "infection_date": "string",
            "ip": "127.0.0.1",
            "language": "string",
            "malware": "string",
            "memory": "string",
            "phone_number": "string",
            "username": "username",
            "victim_os": "string",
            "victim_uid": "9eee4f4d-714d-402f-b9c1-17d4442e0901"
        }
    },
    "content_type": "string",
    "created": "2019-08-24T14:15:22Z",
    "id": 0,
    "status": "in_progress",
    "status_timestamp": "2019-08-24T14:15:22Z"
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

The following Sekoia.io built-in rules match the intake PRODAFT USTA Cyber Threat Intelligence Platform [BETA]. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x PRODAFT USTA Cyber Threat Intelligence Platform [BETA] on ATT&CK Navigator

Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner).

Effort: intermediate

CVE-2020-0688 Microsoft Exchange Server Exploit

Detects the exploitation of CVE-2020-0688. The POC exploit a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to use an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. To exploit this vulnerability, an attacker needs to leverage the credentials of an account it had already compromised to authenticate to OWA.

Effort: elementary

CVE-2020-17530 Apache Struts RCE

Detects the exploitation of the Apache Struts RCE vulnerability (CVE-2020-17530).

Effort: intermediate

CVE-2021-20021 SonicWall Unauthenticated Administrator Access

Detects the exploitation of SonicWall Unauthenticated Admin Access.

Effort: advanced

CVE-2021-20023 SonicWall Arbitrary File Read

Detects Arbitrary File Read, which can be used with other vulnerabilities as a mean to obtain outputs generated by attackers, or sensitive data.

Effort: advanced

CVE-2021-22893 Pulse Connect Secure RCE Vulnerability

Detects potential exploitation of the authentication by-pass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. It is highly recommended to apply the Pulse Secure mitigations and seach for indicators of compromise on affected servers if you are in doubt over the integrity of your Pulse Connect Secure product.

Effort: intermediate

Cryptomining

Detection of domain names potentially related to cryptomining activities.

Effort: master

Detect requests to Konni C2 servers

This rule detects requests to Konni C2 servers. These patterns come from an analysis done in 2022, September.

Effort: elementary

Discord Suspicious Download

Discord is a messaging application. It allows users to create their own communities to share messages and attachments. Those attachments have little to no overview and can be downloaded by almost anyone, which has been abused by attackers to host malicious payloads.

Effort: advanced

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

Effort: master

Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

Effort: master

Koadic MSHTML Command

Detects Koadic payload using MSHTML module

Effort: intermediate

Possible Malicious File Double Extension

Detects request to potential malicious file with double extension

Effort: elementary

ProxyShell Microsoft Exchange Suspicious Paths

Detects suspicious calls to Microsoft Exchange resources, in locations related to webshells observed in campaigns using this vulnerability.

Effort: elementary

Raccoon Stealer 2.0 Legitimate Third-Party DLL Download URL

Detects Raccoon Stealer 2.0 malware downloading legitimate third-party DLLs from its C2 server. These legitimate DLLs are used by the information stealer to collect data on the compromised hosts.

Effort: elementary

Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

Effort: master

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

Effort: elementary

Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

Effort: master

Suspicious Download Links From Legitimate Services

Detects users clicking on Google docs links to download suspicious files. This technique was used a lot by Bazar Loader in the past.

Effort: intermediate

Suspicious TOR Gateway

Detects suspicious TOR gateways. Gateways are often used by the victim to pay and decrypt the encrypted files without installing TOR. Tor intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

Effort: advanced

Suspicious URI Used In A Lazarus Campaign

Detects suspicious requests to a specific URI, usually on an .asp page. The website is often compromised.

Effort: intermediate

TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`Authentication logs`	USTA Account Takeover Prevention trackers monitor leaked, compromised, stolen device credentials

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	`alert`
Category	`iam`, `threat`
Type	`indicator`, `info`

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

test_usta_atp_incident.json

{
    "message": "{\n  \"company\": {\n    \"id\": 0,\n    \"name\": \"string\"\n  },\n  \"content\": {\n    \"is_corporate\": true,\n    \"password\": \"string\",\n    \"password_complexity\": {\n      \"contains\": {\n        \"lowercase\": 0,\n        \"numbers\": 0,\n        \"other\": 0,\n        \"punctuation\": 0,\n        \"separators\": 0,\n        \"symbols\": 0,\n        \"uppercase\": 0\n      },\n      \"length\": 0,\n      \"score\": \"very_weak\"\n    },\n    \"source\": \"malware\",\n    \"url\": \"http://example.com\",\n    \"username\": \"username\",\n    \"victim_detail\": {\n      \"computer_name\": \"string\",\n      \"country\": \"string\",\n      \"cpu\": \"string\",\n      \"gpu\": \"string\",\n      \"infection_date\": \"string\",\n      \"ip\": \"127.0.0.1\",\n      \"language\": \"string\",\n      \"malware\": \"string\",\n      \"memory\": \"string\",\n      \"phone_number\": \"string\",\n      \"username\": \"username\",\n      \"victim_os\": \"string\",\n      \"victim_uid\": \"9eee4f4d-714d-402f-b9c1-17d4442e0901\"\n    }\n  },\n  \"content_type\": \"string\",\n  \"created\": \"2019-08-24T14:15:22Z\",\n  \"id\": 0,\n  \"status\": \"in_progress\",\n  \"status_timestamp\": \"2019-08-24T14:15:22Z\"\n}",
    "event": {
        "category": [
            "iam",
            "threat"
        ],
        "kind": "alert",
        "outcome": "success",
        "type": [
            "indicator",
            "info"
        ]
    },
    "observer": {
        "product": "USTA",
        "vendor": "PRODAFT"
    },
    "prodaft": {
        "usta": {
            "atp": {
                "event": {
                    "id": "0"
                },
                "iscorporate": true,
                "source": "malware",
                "victimdetails": {
                    "computername": "string",
                    "computerusername": "username",
                    "cpu": "string",
                    "gpu": "string",
                    "infectiondate": "string",
                    "language": "string",
                    "malware": "string",
                    "memory": "string",
                    "phonenumber": "string"
                }
            }
        }
    },
    "related": {
        "ip": [
            "127.0.0.1"
        ],
        "user": [
            "username"
        ]
    },
    "source": {
        "address": "127.0.0.1",
        "geo": {
            "country_name": "string"
        },
        "ip": "127.0.0.1"
    },
    "url": {
        "domain": "example.com",
        "full": "http://example.com",
        "original": "http://example.com",
        "port": 80,
        "registered_domain": "example.com",
        "scheme": "http",
        "top_level_domain": "com"
    },
    "user": {
        "name": "username"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`event.category`	`keyword`	Event category. The second categorization field in the hierarchy.
`event.kind`	`keyword`	The kind of the event. The highest categorization field in the hierarchy.
`event.outcome`	`keyword`	The outcome of the event. The lowest level categorization field in the hierarchy.
`event.type`	`keyword`	Event type. The third categorization field in the hierarchy.
`observer.product`	`keyword`	The product name of the observer.
`observer.vendor`	`keyword`	Vendor name of the observer.
`prodaft.usta.atp.event.id`	`keyword`	Event ID associated with the alert in USTA Account Takeover Prevention Ticket
`prodaft.usta.atp.iscorporate`	`boolean`	USTA Account Takeover Prevention - Is it a corporate victim
`prodaft.usta.atp.source`	`keyword`	USTA Account Takeover Prevention - Intelligence Source
`prodaft.usta.atp.victimdetails.computername`	`keyword`	USTA Account Takeover Prevention - Computer Name of compromised device
`prodaft.usta.atp.victimdetails.computerusername`	`keyword`	USTA Account Takeover Prevention - User Name of compromised device
`prodaft.usta.atp.victimdetails.cpu`	`text`	USTA Account Takeover Prevention - CPU of compromised device
`prodaft.usta.atp.victimdetails.gpu`	`text`	USTA Account Takeover Prevention - GPU of compromised device
`prodaft.usta.atp.victimdetails.infectiondate`	`keyword`	USTA Account Takeover Prevention - Infection Date of compromised device
`prodaft.usta.atp.victimdetails.language`	`keyword`	USTA Account Takeover Prevention - Language of compromised device
`prodaft.usta.atp.victimdetails.malware`	`keyword`	USTA Account Takeover Prevention - Malware Type
`prodaft.usta.atp.victimdetails.memory`	`keyword`	USTA Account Takeover Prevention - Memory of compromised device
`prodaft.usta.atp.victimdetails.os`	`text`	USTA Account Takeover Prevention - OS of compromised device
`prodaft.usta.atp.victimdetails.phonenumber`	`keyword`	USTA Account Takeover Prevention - Phone Number of compromised device
`source.geo.country_name`	`keyword`	Country name.
`source.ip`	`ip`	IP address of the source.
`url.original`	`wildcard`	Unmodified original url as seen in the event source.
`user.name`	`keyword`	Short name or login of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.