How to Screen (Potentially) Malicious URLs
Hi all -
I am still a new cyber analyst, and I often check IOCs that I find in the news for any prevalence in my environment.
One thing I struggle with is determining if the site is truly malicious or not. I am looking for some feedback on what else I can check for to determine if these sites are suspicious, malicious, etc.
My current process:
- Check news for IOC (Domain in this case)
- KQL to search for any URLClicks/RemoteURL connections
- I receive results that a device connected to the (potentially) malicious URL
- Check VT for reputation
- Check proxy for confirmation of connection to the site
- Sandbox the URL
- Check device timeline for around the time of the URL click
Where I struggle is with this.
- When I sandbox the URL, I don't see anything malicious.
- What should I be looking for?
- What should I check to determine if this is a legitimate site, or a malicious one.
- What indicators on the site truly determine maliciousness, and how can I find them?
- When I check VT, what should I look for on here aside for the 'Reputation Score'/Community score
- Is there anything on here I can look for on here to assist me in determining if this site is malicious or not?
- Is there anything else I can check? I feel like all I do is visit the site, click around, then that's it. I never seem to find any .exe, scripts, etc.
A most recent example of sites would be survey-smiles[.]com. Clearly malicious, but, what should be 'THE' process for analyzing these URLs?
I know this is a dumb question, but I honestly don't know how to check for these things, and my team is relatively new as well. Any pointers would be greatly appreciated!