ThreatClaw · Investigation Playbook

Network investigation: ThreatClaw - domaine imitant amazon (requete DNS)

NIDS SuricataRule sid:8400017

  1. Confirm the network alert

    Signature: **ThreatClaw - domaine imitant amazon (requete DNS)** Class: social-engineering. Re-read the matched content and the triggering packet; confirm the traffic genuinely matches the signature and not a legitimate use.

  2. Identify both endpoints

    • Source IP and destination IP of the session
    • Internal (HOME_NET) vs external: which one initiates the connection?
    • Resolve the names and map the affected internal asset

  3. Reputation of the external endpoint

    • Reputation of the remote IP/domain (IOC feed, VirusTotal, WHOIS)
    • Recently registered domain (NRD)?

  4. Capture and pivot on the flow

    • Extract the full pcap of the session (both directions)
    • Correlate with host telemetry on both endpoints (process, connection, user) to find what generated the traffic

  5. Fleet scope

    • Other hosts triggering the same sid (8400017)
    • Other hosts contacting the same destination

  6. Response (informational, HITL)

    ⚠️ No automatic action. Blocking the flow at the firewall / network-quarantining the host, to be decided by a human once the threat is confirmed.