EXPLORE
← Back to Explore
T1583.001

Domains

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains th...

PRE
61
Detections
2
Sources
40
Threat Actors

BY SOURCE

60sublime1elastic

PROCEDURES (21)

Authentication Monitoring18 detections

Auto-extracted: 18 detections for authentication monitoring

Email Security10 detections

Auto-extracted: 10 detections for email security

Network Connection Monitoring8 detections

Auto-extracted: 8 detections for network connection monitoring

Service4 detections

Auto-extracted: 4 detections for service

Credential3 detections

Auto-extracted: 3 detections for credential

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Email1 detections

Auto-extracted: 1 detections for email

Service1 detections

Auto-extracted: 1 detections for service

Office1 detections

Auto-extracted: 1 detections for office

Email1 detections

Auto-extracted: 1 detections for email

General Monitoring1 detections

Auto-extracted: 1 detections for general monitoring

Phish1 detections

Auto-extracted: 1 detections for phish

Cloud1 detections

Auto-extracted: 1 detections for cloud

Phish1 detections

Auto-extracted: 1 detections for phish

Phish1 detections

Auto-extracted: 1 detections for phish

Credential1 detections

Auto-extracted: 1 detections for credential

Cloud1 detections

Auto-extracted: 1 detections for cloud

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Cloud1 detections

Auto-extracted: 1 detections for cloud

Office1 detections

Auto-extracted: 1 detections for office

DETECTIONS (61)

AWS Route 53 Private Hosted Zone Associated With a VPC
elasticmedium
Brand impersonation: American Express (AMEX)
sublimelow
Brand impersonation: Aramco
sublimemedium
Brand impersonation: AuthentiSign
sublimemedium
Brand impersonation: Bank of America
sublimehigh
Brand impersonation: Barracuda Networks
sublimemedium
Brand impersonation: Binance
sublimemedium
Brand impersonation: Blockchain[.]com
sublimemedium
Brand impersonation: Capital One
sublimehigh
Brand impersonation: Charles Schwab
sublimemedium
Brand impersonation: Chase Bank
sublimehigh
Brand impersonation: Coinbase
sublimehigh
Brand impersonation: DHL
sublimelow
Brand impersonation: DigitalOcean
sublimehigh
Brand impersonation: DocSend
sublimehigh
Brand impersonation: DocuSign
sublimehigh
Brand impersonation: Fastway
sublimemedium
Brand impersonation: FedEx
sublimelow
Brand impersonation: FINRA
sublimemedium
Brand impersonation: Github
sublimehigh
Brand impersonation: Google using Microsoft Forms
sublimehigh
Brand impersonation: Google Workspace alert notification
sublimemedium
Brand impersonation: Gusto
sublimemedium
Brand impersonation: Hulu
sublimemedium
Brand impersonation: Interac
sublimemedium
Brand impersonation: KnowBe4
sublimemedium
Brand impersonation: Ledger
sublimelow
Brand impersonation: LinkedIn
sublimemedium
Brand impersonation: Meta and subsidiaries
sublimemedium
Brand impersonation: Netflix
sublimelow
Brand impersonation: Office 365 mail service
sublimemedium
Brand impersonation: Okta
sublimemedium
Brand impersonation: Outlook
sublimehigh
Brand Impersonation: PayPal
sublimemedium
Brand impersonation: PNC
sublimemedium
Brand Impersonation: ShareFile
sublimemedium
Brand impersonation: Silicon Valley Bank
sublimemedium
Brand impersonation: Spotify
sublimelow
Brand Impersonation: Stripe
sublimehigh
Brand impersonation: Sublime Security
sublimehigh
Brand impersonation: TurboTax
sublimelow
Brand impersonation: Twitter
sublimemedium
Brand impersonation: UK government Home Office
sublimehigh
Brand impersonation: UPS
sublimelow
Brand impersonation: Vanta
sublimelow
Brand impersonation: Venmo
sublimemedium
Brand impersonation: Wells Fargo
sublimehigh
Brand impersonation: Wix
sublimemedium
Current event: CrowdStrike impersonation
sublimelow
Fraudulent e-commerce operators
sublimehigh
Impersonation: Chrome Web Store policy
sublimelow
Impersonation: Suspected supplier impersonation with suspicious content
sublimehigh
Link to a domain with punycode characters
sublimemedium
Link: HR impersonation with suspicious domain indicators and credential theft
sublimehigh
Link: Recipient domain in URL path
sublimehigh
Lookalike sender domain (untrusted sender)
sublimehigh
Punycode sender domain
sublimehigh
Sharepoint link likely unrelated to sender
sublimemedium
Spam/fraud: Predatory journal/research paper request
sublimemedium
Suspected lookalike domain with suspicious language
sublimemedium
Vendor impersonation: Thread hijacking with typosquat domain
sublimehigh