TA4903 and Me: Using Domain and DNS Intel Against BEC

Date: Thursday, March 20th

Time: 10am PT/ 1pm ET

Business Email Compromise (BEC) has the ability to impact all organizations. It can cause damage to companies from both a financial and reputational perspective. BEC tactics, such as thread hijacking, may also result in the theft of intellectual property and/or leaks of sensitive business information (i.e. pending mergers and acquisitions).

It’s our goal at DomainTools to ensure our customers are using our tools to their fullest capabilities. In this live presentation, our team will use our domain and DNS intelligence platform to demonstrate how to stay ahead of BEC using the example of TA4903, a financially motivated threat actor with notoriously high campaign volume.

In this closed event for DomainTools customers only, the audience will walk with with the following: 

• Investigate IOCs for increased context and find connected domains
• Understand how to create a fingerprint within Iris Investigate’s Advanced Search
• Leverage passive DNS to uncover connected subdomains
• Discuss automating discovery within Splunk SIEM environment for continued domain discovery