Lists the type of alert and the subdomain that triggered the alert.

Example: 
"A Potentially Internal Subdomain is Exposed - <subdomain>"

Descriptions include the following:

• Information on whether the subdomain can be reached through a browser.
• The keyword that triggered the alert.
• Name of subdomain.
• IP address to which the subdomain resolves.
• Screenshot of the website, if available. If the website becomes available in the future, the Threat Bulletin is updated with a screenshot.

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• exposed-subdomains: Enables filtering based on exposed subdomain registration alerts.

• website-hosted: Added when a website is hosted on the exposed subdomain.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example: 

• keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• Assess whether the site available on the subdomain is indeed internal. If it is internal, its public access should be revoked.

• Check any services running on additional ports exposed to the Internet and have appropriate controls in place to limit external access. This must be done because ATTM only checks whether a website is hosted on an exposed subdomain (ports 80 and 443) to avoid running an active port scan against your infrastructure.
  Example:

  Use observables or ThreatModel search filter to find exposed subdomains where a website is hosted

  tag = "anomali-targeted-threat-monitoring" and tag = "exposed-subdomains" and tag = “website-hosted”

Lists the type of alert and the keyword that triggered the alert.

<number> Employee Credentials Found in Initial Scan - <keyword>

Descriptions include the following:

• Contents of related CSV file: Name, Email, Physical Address, Contact number, Plaintext Password, Hashed Password, and Leak Source.

  Note: Critical PII information is partially redacted.

• Attachment with a password-protected zip file to look at plaintext passwords or other PII information. The file name is leaked_data.zip and the password is the API key for the ATTM service.

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• leaked-credential: Enables filtering based on leaked credential alerts.

• LeakedData:<type of data>: Possible tags include LeakedData:HashedPassword, LeakedData:Phone, LeakedData:Address, and LeakedData:PlainTextPassword.

• PlainTextPassword:<redacted password>: Added for alerts that contain plain text password leaks.

• HashedPassword:<hashed password>: Added for alerts that contain hashed password leaks.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example: keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

• email: Indicates that the alert includes one or more compromised email addresses.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context available, one or more of the following recommendations is included:

• Reset your employee’s passwords to any external or internal resource, especially if hashed or plaintext passwords are leaked.

• Set up monitoring for suspicious login activity or password failures for email addresses.

• Alert employees of the matter.

Examples:

Use observables/ThreatModel search filter to find:

• User emails with either leaked plaintext or hashed passwords.

tag = "anomali-targeted-threat-monitoring" and tag = "leaked-credential" and (tag “LeakedData:HashedPassword” or tag = “LeakedData:PlainTextPassword”)

• User emails with leaked phone numbers.

tag = "anomali-targeted-threat-monitoring" and tag = "leaked-credential" and tag = “LeakedData:Phone”

Lists the type of alert and the domain that triggered the alert.

Example:
‘New Similar Domain - anomali.online’

Descriptions include the following:

• Which company's domain the new domain relates to.

• Website associated with the domain.

• Screenshot of the website, if available. If the website becomes available in the future, the Threat Bulletin is updated with a screenshot.

• Registrar information and contact details.

• Hosting information and contact details.

• IP address associated with the domain.

• Attachments containing letters with relevant contact information.

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• similar-domain-registration: Enables filtering based on similar domain registration alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

• <types of extracted indicators>: Observable types extracted from the alert and associated with the Threat Bulletin.

  Examples:

 domain, url

Depending on the information available, one or more of the following letter templates are attached to the Threat Bulletin:

• takedown_letter_to_registrar.html

• takedown_letter_to_hosting_company.html

• takedown_letter_to_website_owner.html

You can use these letters and the contact information listed in the Threat Bulletin description to complete threat remediation.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

Similar domain registration

• Try to take a similar domain down if it violates a brand’s trademark. If unsuccessful, submit a claim through ICANN’s Uniform Domain Name Dispute Resolution Policy. Anomali will continue monitoring the domain for 30 days and update the alert if a website is set up at a later point.

• Blacklist a suspicious domain in any URL and mailing system to prevent employees from accessing it or recovering phishing letters originating from it. Send a domain takedown request to the email ID of the Registrar and hosting provider in the Threat Bulletin. The prefilled takedown email template is attached.
  Example:

  Use observables/ThreatModel search filter to find similar domain registrations.
  tag = "anomali-targeted-threat-monitoring" and tag = "similar-domain-registration" and NOT (tag = "phishing" OR tag = "brand-abuse" OR tag = "suspicious-ssl-certificate")

  Potential brand abuse

  • Investigate the website contents to determine its threat to a brand name. If the website and or domain are suspected to be associated with malicious activity targeting Anomali or violation of a brand name’s trademark, attempt to take both down.
    Example:
    Use observables/ThreatModel search filter to find websites and domains that may violate a brand name’s trademark.
    tag = "anomali-targeted-threat-monitoring" and tag = "brand-abuse"
    Potential phishing
    In case of a phishing attack targeting a brand name:

  • Contact the abuse department of the company the attack is hosted by and request to take the domain down.
  • Contact the Registrar if the phishing attack has a unique domain name.
  • Call the hosting company to expedite the process. The longer the site is online, the more credentials can be stolen.
    Example:
    Use observables/ThreatModel search filter to find potential phishing attacks targeting your company’s brand name.
    tag = "anomali-targeted-threat-monitoring" and tag = "phishing"

Lists the type of alert and the domain that triggered the alert.

Descriptions include the following:

• Domain that is about to expire

• Information on its potential impact

• Registration date

• Expiration date

Domain Expiration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• domain-expiration: Enables filtering based on domain expiration alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

• keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• Verify that your OPS team plans to renew the domain registration.

• If your domain expires, purchase the domain again before somebody else gets hold of it.

Lists the type of alert and the domain that triggered the alert.

Descriptions include the following:

• Domain name
• New IP address the domain points to
• Hosting company
• Contact information required to report abuse
• Contact information for the website administrator

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• domain-hijacking: Enables filtering based on domain hijacking alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• Investigate whether the suspected IP address associated with the domain is legitimately used by the customer or their service providers.

• When the IP address is unfamiliar, verify that the domain is unexpired. If the domain is still owned by the Customer, but it points to an unfamiliar IP address, investigate the site pointed to the domain to determine the nature and severity of the threat. Contact the domain Registrar, if a threat is identified.

• Refer to the Threat Bulletin description for details of the hosting provider that controls the IP address in case you want to initiate website takedown manually.

Lists the type of alert and the brand that triggered the alert.

Descriptions include the following:

• Name of the App Store where the application is hosted
• URL of the App Store
• Name of the application
• Application category
• Developer name
• Version
• Publishing date
• Description of application on the store

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• rogue-app: Enables filtering based on rogue app alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example: 

• keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• Verify that the app is an unsanctioned application developed by a third party.

• Contact the app store owners and request to take the app down if you are confident that it violates your intellectual property rights.

• Refer to the Threat Bulletin description for a link to the official takedown page. Using an integrator, block a specific URL in your IPS using to prevent your employees from downloading the app.

Lists the type of alert and the fake Twitter account that triggered the alert.

Descriptions include the following:

• Twitter URL

• Twitter handle and username

• Date of account registration

• Number of followers and posts

• Last post

• Account profile picture, if available

Fake Twitter account Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• fake-twitter-accounts: Enables filtering based on fake twitter account alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

Example:

keyword:anomali.com

severity:<level>: Severity value assigned to the threat. Possible values include very high, high, medium, low, and very low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

If the account is found to be abusing Anomali's brand, trademark, or intellectual property, request Twitter to take it down. To report the account, do the following:

1. Open the Twitter handle.

2. Click the three dots button.

3. Select Report @UserAnomali.

4. Select They're pretending to be me or someone else.

5. Select My company or brand.

You will be requested to provide Anomali's real Twitter account as well as a contact email to send the report to the Twitter's abuse team. Note that you must be logged in to your Twitter account to report an account.

Lists the type of alert and the brand that triggered the alert.

Descriptions include the following:

• URL of the pastebin post

• Post title

• Pastebin user

• Post date

• Post content

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• pastebin-brand-mention: Enables filtering based on pastebin brand mention alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Lists the type of alert and the document that triggered the alert.

Descriptions include the following:

• URL of the file
• S3 bucket (if found on S3)

• Screenshot of the leaked document

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• leaked-document: Enables filtering based on leaked document alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.
  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• Review the document to determine whether it includes Anomali classified information.

• Submit a takedown request if a sensitive document is found in a public sandbox such as Hybrid Analysis or Joe Sandbox.

• Report to AWS and request to take the sensitive document down, if it is found in a publicly exposed AWS bucket not owned by your organization.

• Request your operations team to either take the sensitive document down or assign an appropriate access level control to it, if it is found in an AWS bucket owned by your organization.

Lists the type of alert and the brand that triggered the alert.

Descriptions include the following:

• Name of the repository
• URL of the repository
• Creation and update dates
• Owner of the repository
• URL of the file containing the keyword
• File code

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• leaked-code-monitor: Enables filtering based on leaked code monitor alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example: 

• keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Recommendations

Depending on the context, one or more of the following recommendations is included:

• Review the contents of the file. If the code contains any abusive or unauthorized content, request GitHub to take it down. For details, see Report Abuse.

• If the leaked code contains sensitive information such as API keys, private keys, or passwords, reset them as soon as possible.

Lists the type of alert and the brand that triggered the alert.

Descriptions include the following:

• Trademarked brand
• Filing status
• Trademark applicant
• Country of the trademark holder
• Filing number
• Country in which the trademark was filed
• Filing date
• Logo associated with trademark request

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• trademark-filing: Enables filtering based on trademark filing alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example: 

• keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Depending on the context, one or more of the following recommendations is included:

• If the trademark application was filed by a third party, assess whether it infringes on Tradeweb’s trademark. Reach out for a consultation to trademark attorneys of the appropriate country if the application appears to be an infringement.

• Use ThreatStream rules to automatically send email notifications to the legal team when this type of alert is triggered. To create the rule, use the following Threat Model search filter:

  tag = "anomali-targeted-threat-monitoring" and tag = “trademark-filing”

Lists the type of alert and the keyword that triggered the alert.

Descriptions include the following:

• Information on the vulnerability
• Impacted mail servers

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• email-vulnerability: Enables filtering based on email vulnerability alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.

Depending on the context, one or more of the following recommendations is included:

• If the alert title contains the string “Missing SPF and DMARC Records”, add SPF, DKIM, and DMARC records to the domains' DNS records. For more information on the records, see What are DMARC, SPF and DKIM? How to master email security with these protocols.

• If the alert title contains the string “SMTP Servers do not Support TLS”, verify that the servers do not support TLS. If this is the case, enable TLS support for secure email communication.

Lists the type of alert and the domain that triggered the alert.

Descriptions include the following:

• Location of SSL certificate expiration warning
• Matched keyword
• Related domain
• Expiration date
• Certificate issue date

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• ssl-certificate-validity: Enables filtering based on ssl certificate validity alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

• expired-certificate, invalid-signature, invalid-timestamp, revoked-certificate: One of the preceding tags is added depending on the context of the alert.

Depending on the context, one or more of the following recommendations is included:

• If the tile contains the “SSL Certificate has a Wrong Hostname” phrase, validate the issue found in the certificate. If the issue indeed affects the security of the website, you replace the certificate. You can access this domain with multiple browsers and check if a warning is generated. Additionally, use an SSL certificate checking tool, such as SSL Labs, to identify any additional issues.

• If the title contains the “SSL Certificate is About to Expire” phrase, notify your IT team immediately to renew the certificate. You can use ThreatStream rules to send an automated email to your IT or OPS team about this type of alert. Use the following Threat Model search filter when creating a rule:

  tag = "anomali-targeted-threat-monitoring" and tag = “ssl-certificate-validity” and name contains "SSL Certificate is About to Expire"

• If the title contains the “SSL Certificate has Expired” phrase, notify the OPS and IT team and request them to get the domain back immediately. If it is already taken over by someone else, raise a claim against the Registrar. You can use ThreatStreamrules to send an automated email to your IT and OPS team about this type of alert. Use the following Threat Model search filter when creating a rule:

  tag = "anomali-targeted-threat-monitoring" and tag = “ssl-certificate-validity” and name contains "SSL Certificate has Expired"

Lists the type of alert and the domain that triggered the alert.

Descriptions include the following:

• Location of the leaked information
• Matched keyword

Similar domain registration Threat Bulletins are appended with the following tags:

• anomali-targeted-threat-monitoring: Added to all ATTM Threat Models and related observables.

• leaked-email: Enables filtering based on leaked email alerts.

• keyword:<related keyword>: Organization keyword the alert relates to.

  Example:

•  keyword:anomali.com

• severity:<level>: Severity value assigned to the threat. Possible values include very-high, high, medium, low, very-low.

Observables extracted from the alert. In addition to the tags listed below, all associated observables carry the tags appended to the parent Threat Bulletin.