Investigating threats using Google

While Google is not a TIP, it is helpful for investigating threats artifacts such as domain names, filenames, and user agents. By enclosing the suspicious value within double quotes ("") during a search, you may get interesting search results. For example, during the investigation, you find a suspicious user agent of a web communication traffic, and after searching for it on Google, you find a threat report saying that the user agent string was used by a threat actor for its C&C communications. Similarly, you may find suspicious web communications with a web domain, which you want to investigate by using Google, and after searching, you find it doesn’t have a GUI and exists in one of the threat intelligence reports, indicating that the domain is the C&C server of a specific threat actor. See Figure 14.22:

Figure 14.22 – Investigating a suspicious domain using Google

As you can see in the preceding screenshot, by investigating the suspicious domain, hueref[.]eu, using the Google search engine, we found a threat report, tweet, and malware sandboxing report that indicate that the domain is a C&C domain.

By the end of this section, you should have learned how to investigate the threats by using the Google search engine.