Investigating threats using Google
While Google is not a TIP, it is helpful for investigating threats artifacts such as domain names, filenames, and user agents. By enclosing the suspicious value within double quotes ("") during a search, you may get interesting search results. For example, during the investigation, you find a suspicious user agent of a web communication traffic, and after searching for it on Google, you find a threat report saying that the user agent string was used by a threat actor for its C&C communications. Similarly, you may find suspicious web communications with a web domain, which you want to investigate by using Google, and after searching, you find it doesn’t have a GUI and exists in one of the threat intelligence reports, indicating that the domain is the C&C server of a specific threat actor. See Figure 14.22:
Figure 14.22 – Investigating a suspicious domain using Google
As you can see in the...
