Prodaft USTA

Overview

USTA is a market-leading threat intelligence solution provided by PRODAFT specifically designed to combat ransomware, online fraud, and account takeover attempts.

Vendor: PRODAFT
Supported product: USTA - Account Takeover Prevention
Supported data source: USTA Compromised credentials feed
Supported environment: Cloud / SaaS
Detection based on: External credential compromise intelligence

This integration enables the ingestion of compromised credential feeds generated by the USTA Account Takeover module into Sekoia.io.

The feed provides indicators related to exposed or compromised user accounts, allowing SOC teams to correlate external credential compromise signals with authentication activity, detect account takeover attempts, and prioritize remediation actions.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Detection

Collecting compromised credential events from USTA enables several security detection and investigation use cases within Sekoia.io.

Example use cases

Detection of internal authentication attempts involving externally compromised accounts.
Prioritization of account remediation based on risk details provided.
Correlation with IAM, VPN, or SaaS authentication logs to identify potential account takeover activity.
Threat hunting on users exposed in recent credential leaks.

Configure

Prerequisites

Before configuring the integration, ensure that you have:

Access to the USTA platform.
Access to the Company - Integrations module (admin privilege or special permissions might be required).
The required credentials to retrieve the compromised credentials feed (API token).
A Sekoia.io account with permissions to create and manage intakes.

Create USTA credentials

Log in to the USTA platform.
Navigate to the Management -> Company Settings -> Integrations -> API keys.
Locate your API token and copy it.
Save these credentials for use in Sekoia.io.

Instruction on Sekoia

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

test_usta_atp_incident

{
    "company": {
        "id": 0,
        "name": "string"
    },
    "content": {
        "is_corporate": true,
        "password": "string",
        "password_complexity": {
            "contains": {
                "lowercase": 0,
                "numbers": 0,
                "other": 0,
                "punctuation": 0,
                "separators": 0,
                "symbols": 0,
                "uppercase": 0
            },
            "length": 0,
            "score": "very_weak"
        },
        "source": "malware",
        "url": "http://example.com",
        "username": "username",
        "victim_detail": {
            "computer_name": "string",
            "country": "string",
            "cpu": "string",
            "gpu": "string",
            "infection_date": "string",
            "ip": "127.0.0.1",
            "language": "string",
            "malware": "string",
            "memory": "string",
            "phone_number": "string",
            "username": "username",
            "victim_os": "string",
            "victim_uid": "9eee4f4d-714d-402f-b9c1-17d4442e0901"
        }
    },
    "content_type": "string",
    "created": "2019-08-24T14:15:22Z",
    "id": 0,
    "status": "in_progress",
    "status_timestamp": "2019-08-24T14:15:22Z"
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`Authentication logs`	USTA Account Takeover Prevention trackers monitor leaked, compromised, stolen device credentials

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	`alert`
Category	`iam`, `threat`
Type	`indicator`, `info`

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

test_usta_atp_incident.json

{
    "message": "{\n  \"company\": {\n    \"id\": 0,\n    \"name\": \"string\"\n  },\n  \"content\": {\n    \"is_corporate\": true,\n    \"password\": \"string\",\n    \"password_complexity\": {\n      \"contains\": {\n        \"lowercase\": 0,\n        \"numbers\": 0,\n        \"other\": 0,\n        \"punctuation\": 0,\n        \"separators\": 0,\n        \"symbols\": 0,\n        \"uppercase\": 0\n      },\n      \"length\": 0,\n      \"score\": \"very_weak\"\n    },\n    \"source\": \"malware\",\n    \"url\": \"http://example.com\",\n    \"username\": \"username\",\n    \"victim_detail\": {\n      \"computer_name\": \"string\",\n      \"country\": \"string\",\n      \"cpu\": \"string\",\n      \"gpu\": \"string\",\n      \"infection_date\": \"string\",\n      \"ip\": \"127.0.0.1\",\n      \"language\": \"string\",\n      \"malware\": \"string\",\n      \"memory\": \"string\",\n      \"phone_number\": \"string\",\n      \"username\": \"username\",\n      \"victim_os\": \"string\",\n      \"victim_uid\": \"9eee4f4d-714d-402f-b9c1-17d4442e0901\"\n    }\n  },\n  \"content_type\": \"string\",\n  \"created\": \"2019-08-24T14:15:22Z\",\n  \"id\": 0,\n  \"status\": \"in_progress\",\n  \"status_timestamp\": \"2019-08-24T14:15:22Z\"\n}",
    "event": {
        "category": [
            "iam",
            "threat"
        ],
        "kind": "alert",
        "outcome": "success",
        "type": [
            "indicator",
            "info"
        ]
    },
    "observer": {
        "product": "USTA",
        "vendor": "PRODAFT"
    },
    "prodaft": {
        "usta": {
            "atp": {
                "event": {
                    "id": "0"
                },
                "iscorporate": true,
                "source": "malware",
                "victimdetails": {
                    "computername": "string",
                    "computerusername": "username",
                    "cpu": "string",
                    "gpu": "string",
                    "infectiondate": "string",
                    "language": "string",
                    "malware": "string",
                    "memory": "string",
                    "phonenumber": "string"
                }
            }
        }
    },
    "related": {
        "ip": [
            "127.0.0.1"
        ],
        "user": [
            "username"
        ]
    },
    "source": {
        "address": "127.0.0.1",
        "geo": {
            "country_name": "string"
        },
        "ip": "127.0.0.1"
    },
    "url": {
        "domain": "example.com",
        "full": "http://example.com",
        "original": "http://example.com",
        "port": 80,
        "registered_domain": "example.com",
        "scheme": "http",
        "top_level_domain": "com"
    },
    "user": {
        "name": "username"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`event.category`	`keyword`	Event category. The second categorization field in the hierarchy.
`event.kind`	`keyword`	The kind of the event. The highest categorization field in the hierarchy.
`event.outcome`	`keyword`	The outcome of the event. The lowest level categorization field in the hierarchy.
`event.type`	`keyword`	Event type. The third categorization field in the hierarchy.
`observer.product`	`keyword`	The product name of the observer.
`observer.vendor`	`keyword`	Vendor name of the observer.
`prodaft.usta.atp.event.id`	`keyword`	Event ID associated with the alert in USTA Account Takeover Prevention Ticket
`prodaft.usta.atp.iscorporate`	`boolean`	USTA Account Takeover Prevention - Is it a corporate victim
`prodaft.usta.atp.source`	`keyword`	USTA Account Takeover Prevention - Intelligence Source
`prodaft.usta.atp.victimdetails.computername`	`keyword`	USTA Account Takeover Prevention - Computer Name of compromised device
`prodaft.usta.atp.victimdetails.computerusername`	`keyword`	USTA Account Takeover Prevention - User Name of compromised device
`prodaft.usta.atp.victimdetails.cpu`	`text`	USTA Account Takeover Prevention - CPU of compromised device
`prodaft.usta.atp.victimdetails.gpu`	`text`	USTA Account Takeover Prevention - GPU of compromised device
`prodaft.usta.atp.victimdetails.infectiondate`	`keyword`	USTA Account Takeover Prevention - Infection Date of compromised device
`prodaft.usta.atp.victimdetails.language`	`keyword`	USTA Account Takeover Prevention - Language of compromised device
`prodaft.usta.atp.victimdetails.malware`	`keyword`	USTA Account Takeover Prevention - Malware Type
`prodaft.usta.atp.victimdetails.memory`	`keyword`	USTA Account Takeover Prevention - Memory of compromised device
`prodaft.usta.atp.victimdetails.os`	`text`	USTA Account Takeover Prevention - OS of compromised device
`prodaft.usta.atp.victimdetails.phonenumber`	`keyword`	USTA Account Takeover Prevention - Phone Number of compromised device
`source.geo.country_name`	`keyword`	Country name.
`source.ip`	`ip`	IP address of the source.
`url.original`	`wildcard`	Unmodified original url as seen in the event source.
`user.name`	`keyword`	Short name or login of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.