Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The WMC Global CDF integration imports phishing intelligence and compromised credential data from WMC Global into ThreatQ. The integration enables organizations to ingest newly identified phishing URLs, monitor for compromised payment cards and account credentials, and correlate this intelligence with existing ThreatQ data to support phishing investigations, fraud detection, and threat response activities.

Powered by WMC Global's PhishFeed and VicSearch services, the integration provides visibility into active phishing campaigns and exposed credentials associated with your organization. By centralizing this intelligence within ThreatQ, security teams can more effectively identify targeted attacks, investigate compromised assets, and prioritize response efforts.

The integration provides the following feeds:

• WMC Global PhishFeed - ingests new phishing URLs and relevant context from WMC Global's PhishFeed.
• WMC Global VicSearch - ingests phishing URLs and compromised credential context from WMC Global's VicSearch.

The integration ingests the following ThreatQ objects:

• Compromised Accounts (custom object)
• Compromised Cards (custom object)
• Indicators (URLs)

Prerequisites

The integration requires the following to install and run the integration:

• A valid WMC Global API key. Each feed requires a corresponding WMC Global service license (for example, PhishFeed or CCR/VicSearch). Contact WMC Global to obtain the licenses required for the feeds you plan to use.
• The Compromised Account and Compromised Card custom objects installed on your ThreatQ instance.

Compromised Account and Card Custom Objects

The integration requires that the Compromised Account and Compromised Card custom objects be installed on your ThreatQ instance.  

Use the steps provided to install the custom objects.    

When installing the custom objects, be aware that any in-progress feed runs will be cancelled, and the API will be in maintenance mode.

Installation

The integration requires that the Compromised Account and Compromised Card custom objects be installed on your ThreatQ instance prior to installing the CDF.  Failure to install the custom objects will result in the CDF installation process failing. 

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration zip file.
3. Extract and install the required custom objects if you have not done so already.  
4. Navigate to the integrations management page on your ThreatQ instance.
5. Click on the Add New Integration button.
6. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine
7. Select the individual feeds to install, when prompted and click Install.

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

The feed(s) will be added to the integrations page. You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   WMC Global PhishFeed Parameters

   Parameter	Description
   API Key	Enter your WMC Global PhishFeed API key. The API key must have permission to access the PhishFeed service.
   Context Filter	Select the contextual information to import into ThreatQ for each phishing URL. Only the selected fields are ingested. Options include: Related IP Address (default) Threat Actor Emails (default) Impersonated Brand (default) Phishing Kit Names (default) Is Mobile (default) Country Code (default) Region (State) City ASN ASN Organization

   WMC Global VicSearch Parameters

   Parameter	Description
   API Key	Enter your WMC Global API key. The API key must have permission to access the CCR service.
   Brand Filter	Enter a brand name or brand search string to monitor for compromised credentials and phishing URLs. You can use the wildcard character (*) to search across all brands.
   Content Filter	Select the content filter used when searching for compromised credentials and phishing URLs. Options include: Emails (default) Any Content Custom Search
   Custom Search	Enter a custom search string to use when the Content Filter is set to Custom Search.
   Ingest Potentially Compromised Emails	Enable this parameter to ingest email addresses identified within the matched content of phishing pages. This parameter is useful for identifying potentially compromised user credentials. This parameter is disabled by default.
   Ingest Potentially Compromised Credit Cards	Enable this parameter to ingest payment card numbers identified within the matched content of phishing pages. Only values that pass Luhn's Algorithm are imported. This parameter is useful for identifying potentially compromised payment cards. This parameter is disabled by default.
   Ignore Compromised Cards for Keywords	Enter one keyword per line to exclude false-positive payment card matches. This option helps prevent values such as shipping tracking numbers or other numeric identifiers from being imported as compromised payment cards.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

WMC Global PhishFeed

The WMC Global PhishFeed feed ingests new phishing URLs and relevant context from WMC Global's PhishFeed.

GET https://api.phishfeed.com/v2/feed

Sample Response:

{
    "count": 10000,
    "data": [
        {
            "id": 38473852,
            "url": "https://address-confirmation-id7451.line.pm/us/en/homepage%23id10663",
            "ip": "",
            "ip_location": ", , ",
            "ip_as": "",
            "ip_asn": "",
            "date_found": "2024-03-12 13:53:40",
            "brand": "UPS",
            "zip_kits": null,
            "zip_emails": null,
            "mobile": true
        },
        {
            "id": 38473851,
            "url": "https://ups-tracking-id10663.package101.delivery/redelivery%23id10663",
            "ip": "",
            "ip_location": ", , ",
            "ip_as": "",
            "ip_asn": "",
            "date_found": "2024-03-12 13:53:20",
            "brand": "UPS",
            "zip_kits": null,
            "zip_emails": null,
            "mobile": true
        }
    ]
}

ThreatQuotient provides the following default mapping for this feed based on each item within the API response's data array.

WMC Global VicSearch

The WMC Global VicSearch feed ingests phishing URLs and compromised credential context from WMC Global's VicSearch.

POST https://api.phishfeed.com/vicsearch/v3/search

Sample Response:

{
    "total_records": 3,
    "scroll_id": null,
    "phish_data": [
        {
            "brand": "Facebook",
            "date_time": "2021-01-25T21:02:24",
            "last_version_found": null,
            "version_date_time": "2021-01-25T21:08:15+00:00",
            "file_name": "http__mobilefbook-nl6frxck1.nikmehrchap.com_broken.txt",
            "phish_id": 12906858,
            "phish_url": "http://mobilefbook-nl6frxck1.nikmehrchap.com/",
            "highlight": {
                "total_content_matched": 18,
                "returned_content": 18,
                "matched_content": [
                    "owenkay@bell.net",
                    "jasonwleslie@aol.com",
                    "hashimstubbs@aol.com",
                    "mayhayes91@gmail.com",
                    "rickywrightjr@aol.com",
                    "fishingfool004@gmail.com",
                    "brady_vanessa@yahoo.com",
                    "bkspee@aol.com",
                    "bkspee@aol.com",
                    "bkspee@aol.com",
                    "vhammond88@gmail.com",
                    "vhammond88@gmail.com",
                    "cactusowl@gmail.com",
                    "j.braudis@insightbb.com",
                    "j.braudis@insightbb.com",
                    "j.braudis@insightbb.com",
                    "harabisdebra@yahoo.com",
                    "harabisdebra@yahoo.com"
                ]
            }
        },
        {
            "brand": "Facebook",
            "date_time": "2021-01-22T15:46:39",
            "last_version_found": null,
            "version_date_time": "2021-01-22T15:52:57+00:00",
            "file_name": "http__comfacebook-47852227.collectifautisme.ma_broken.txt",
            "phish_id": 12859426,
            "phish_url": "http://comfacebook-47852227.collectifautisme.ma/",
            "highlight": {
                "total_content_matched": 1,
                "returned_content": 1,
                "matched_content": [
                    "lu1s.v@hotmail.com"
                ]
            }
        },
        {
            "brand": "Undetermined",
            "date_time": "2023-06-01T02:26:41+00:00",
            "file_name": "http__rakuntuls.dynnamn.ru_rzltcc.txt",
            "highlight": {
                "matched_content": [
                    "4430576401452017"
                ],
                "returned_content": 1,
                "total_content_matched": 1
            },
            "last_version_found": true,
            "phish_id": "36848918",
            "phish_url": "http://rakuntuls.dynnamn.ru/",
            "version_date_time": "2023-06-03 04:35:51+00:00"
        }
    ]
}

ThreatQuotient provides the following default mapping for this feed based on each item within the API response's array.

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

WMC Global PhishFeed

WMC Global VicSearch

Known Issues / Limitations

• Complex Content Search Queries - Highly complex Custom Search filters may cause the WMC Global API to time out before results are returned. If you experience timeouts, simplify the search query or contact WMC Global for guidance on optimizing your search criteria.

Change Log

• Version 1.0.0
  • Initial release