Network investigation: ThreatClaw - domaine imitant microsoft (TLS SNI)

1. Confirm the network alert

   Signature: **ThreatClaw - domaine imitant microsoft (TLS SNI)** Class: social-engineering. Re-read the matched content and the triggering packet; confirm the traffic genuinely matches the signature and not a legitimate use. Flow direction: `established,to_server` (indicates the session initiator).

2. Identify both endpoints

   • Source IP and destination IP of the session
   • Internal (HOME_NET) vs external: which one initiates the connection?
   • Resolve the names and map the affected internal asset

3. Reputation of the external endpoint

   • Reputation of the remote IP/domain (IOC feed, VirusTotal, WHOIS)
   • Recently registered domain (NRD)?

4. Capture and pivot on the flow

   • Extract the full pcap of the session (both directions)
   • Correlate with host telemetry on both endpoints (process, connection, user) to find what generated the traffic

5. Fleet scope

   • Other hosts triggering the same sid (8400000)
   • Other hosts contacting the same destination

6. Response (informational, HITL)

   ⚠️ No automatic action. Blocking the flow at the firewall / network-quarantining the host, to be decided by a human once the threat is confirmed.