WC-B-01Level 1 · Signal
Visits known-malicious websites
A risky Behavior signal from the web security layer (SSE, web.malicious.visited): this person requested a site that threat intelligence lists as malicious.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.CM-01
- MITRE ATT&CK
-
- T1189
The definition, in detail
Definition
Even when the proxy blocks the page, the request shows what the person will click.
Example
A customer-support agent follows a link from a chat message to a page that serves a fake browser update; the proxy logs the blocked request against his account.
How it is measured
- Source
- Web, CASB & DLP
- Subject
- Person
- Event
- web.malicious.visited
- Risk domain
- Web, cloud and SaaS
- Provenance
- Framework research
How it is used
Programs count "Visits known-malicious websites" per person from Web, CASB & DLP and read it beside the other Web, cloud and SaaS signals; it feeds 1 cohort, 1 sequence and 1 breach scenario.
A "visits known-malicious websites" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0102Installs personal cloud backup tools on enterprise devices
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0171Uses multiple cloud services with overlapping functionality
- I.0180Downloads documents from unrecognized cloud platforms
- I.0384Violates security contract clauses
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0394Supplies or operates vulnerable software or platforms
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
Continue exploring
"Visits known-malicious websites" (WC-B-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/wc-b-01-visits-known-malicious-websites
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.