Phishlabs CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Phishlabs

The Phishlabs feed ingests indicators and related IOCs.

Sample Response:

{
    "metadata": {
        "count": 1
    },
    "incidents": [
        {
            "id": "INC0763488",
            "service": "EIR",
            "title": "Fwd: CONFIRMATION OF YOUR OVERDUE PAYMENT BY ATTACHE FILE",
            "description": "Incident description",
            "status": "Closed",
            "details": {
                "caseType": "Payload",
                "classification": "Do Not Engage",
                "subClassification": "Do Not Engage",
                "severity": null,
                "emailReportedBy": "Billy Smith <bsmith@phishlabs.com>",
                "submissionMethod": "Forwarded",
                "sender": "Billy Smith <bsmith@phishlabs.com>",
                "emailBody": "\"\\r\\n\\r\\nBilly Smith\\r\\n843-283-7421\\r\\n\\r\\nBegin forwarded message:\\r\\n\\r\\nFrom: UN ECOSOC / 2019 <china@medicalcables.eu>\\r\\nDate: November 17, 2019 at 5:22:31 PM EST\\r\\nSubject: CONFIRMATION OF YOUR OVERDUE PAYMENT BY ATTACHE FILE\\r\\nReply-To: <services@etscc.com>\\r\\n\\r\\n [External]\\r\\nDear Sir/Madam, Please confirm the attache message file for more information regard of your payment. Best Regards, World Bank Group Finance Ministry\\r\\n\\r\\nExternal email\\r\\n\\r\\nForward suspicious emails to bad@phishlabs.com\\r\\n\"",
                "urls": [
                    {
                        "url": "http://purl.org/dc/elements/1.1/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "https://www.un.org/press/en/2005/ik486.doc.htm",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://www.un.org/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/xap/1.0/mm/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/pdf/1.3/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/xap/1.0/",
                        "malicious": false,
                        "maliciousDomain": false
                    }
                ],
                "attachments": [
                    {
                        "fileName": "ATT00001.htm",
                        "mimeType": "text/html",
                        "md5": "07cbbf25d210d17c6df7ce17695a8f5f",
                        "sha256": "e19f4d5b6a2341e3ba9437f152f4f6739fd8a0842fbc36d531ffa7ec938a289f",
                        "malicious": false
                    }
                ],
                "furtherReviewReason": null,
                "offlineUponReview": false
            },
            "created": "2019-11-17T22:23:16Z",
            "modified": "2019-11-17T22:37:27Z",
            "closed": "2019-11-17T22:37:27Z",
            "duration": 852
        }
    ]
}

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Published Date	Examples	Notes
.incidents[].title, .incidents[].id	incident.value	N/A	.incidents[].created	"Fwd: CONFIRMATION OF YOUR OVERDUE PAYMENT BY ATTACHE FILE - INC0763488"	An incident's value is in the format {{title}} - {{id}} if .incidents[].title has a value; otherwise, only .incidents[].id is used.
.incidents[].description	incident.description	N/A	.incidents[].created	"Incident description"
.incidents[].id	incident.attribute	ID	.incidents[].created	"INC0763488"
.incidents[].details.caseType	incident.attribute	Case Type	.incidents[].created	"Payload"
.incidents[].details.classification	incident.attribute	Classification	.incidents[].created	"Do Not Engage"
.incidents[].details.subClassification	incident.attribute	Subclassification	.incidents[].created	"Do Not Engage"
.incidents[].details.severity	incident.attribute	Severity	.incidents[].created	"Low"
.incidents[].details.emailReportedBy	incident.attribute	Email Reported By	.incidents[].created	"Billy Smith bsmith@phishlabs.com"
.incidents[].details.emailBody	incident.attribute	Email Body	.incidents[].created	""\r\n\r\nBilly Smith\r\n843-283-7421\r\n\r\nBegin forwarded..."
.incidents[].details.submissionMethod	incident.attribute	Submission Method	.incidents[].created	"Forwarded"
.incidents[].details.sender	incident.attribute	Sender	.incidents[].created	"Billy Smith bsmith@phishlabs.com"
.incidents[].details.furtherReviewReason	incident.attribute	Further Review Reason	.incidents[].created	"reason example
.incidents[].details.offlineUponReview	incident.attribute	Offline Upon Review	.incidents[].created	false
.incidents[].status	incident.attribute	Status	.incidents[].created	"Closed"
.incidents[].modified	incident.attribute	Modified At	.incidents[].created	"2019-11-17T22:23:16Z"
.incidents[].closed	incident.attribute	Closed At	.incidents[].created	"2019-11-17T22:23:16Z"
.incidents[].duration	incident.attribute	Duration	.incidents[].created	852
.incidents[].service	incident.attribute	Service	.incidents[].created	"EIR"
.incidents[].details.urls	indicator.value	URL	.incidents[].created		see URL Indicators mappings
.incidents[].details.attachments	indicator.value	Filename / MD5 / SHA-256	.incidents[].created		see Attachments Indicators mappings
.incidents[].details.sender	indicator.value	Email Address	.incidents[].created	"bsmith@phishlabs.com"	this indicator is parsed by extracting the email from incidents.details.sender

URL Indicator Mapping

Sample Response:

[
  {
    "url": "http://purl.org/dc/elements/1.1/",
    "malicious": false,
    "maliciousDomain": false
},
{
    "url": "https://www.un.org/press/en/2005/ik486.doc.htm",
    "malicious": false,
    "maliciousDomain": false
},
{
    "url": "http://www.un.org/",
    "malicious": false,
    "maliciousDomain": false
}
]

ThreatQuotient provides the following default mapping:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Examples
url	indicator.value	URL	"http://purl.org/dc/elements/1.1/"
malicious	indicator.attribute	Malicious URL	false
maliciousDomain	indicator.attribute	Malicious Domain	true

Attachment Indicators Mapping

Sample Response:

[
  {
    "fileName": "ATT00001.htm",
    "mimeType": "text/html",
    "md5": "07cbbf25d210d17c6df7ce17695a8f5f",
    "sha256": "e19f4d5b6a2341e3ba9437f152f4f6739fd8a0842fbc36d531ffa7ec938a289f",
    "malicious": false
}
]

ThreatQuotient provides the following default mapping:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Examples	Notes
leName	indicator.value	Filename	"ATT00001.htm"	Indicator of type "Filename"
md5	indicator.value	MD5	"07cbbf25d210d17c6df7ce 17695a8f5f"	Indicator of type "MD5"
sha256	indicator.value	SHA-256	"e19f4d5b6a2341e3ba94 37f152f4f6739fd8a0842fb c36d531ffa7ec938a289f"	Indicator of type "SHA-256"
malicious	indicator.attribute	Malicious Domain	true
mimeType	indicator.attribute	Mime Type	"text/html"

An indicator of type Filename, MD5 and SHA-256 will be created from the values of the fields "fileName", "sha256" and "md5". Each of these indicators will have the attributes from the fields "malicious" and "mimeType".

PDF Guides

Document	ThreatQ Version
Phishlabs CDF Guide v1.1.0	4.24.0 or Greater
Phishlabs CDF Guide v1.0.0	4.24.0 or Greater