# US 11,451,564 B1 · Systems and methods for threat disruption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,564 B1 - Document ID: US11451564B1 - Status: Granted - Kind: B1 - Application number: 17/480,316 - Filed: 2021-09-21 - Granted: 2022-09-20 - Earliest claimed: 2021-09-21 - Assignees: ZeroFOX, Inc. - Applicants: ZeroFOX, Inc. - Inventors: Samuel Kevin Small; Michael Morgan Price; Jason Emile Sumpter; James Christopher Foster - Web page: https://patentgrep.com/patent/US11451564B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network. ## Claims ### Claim 1 A method for disrupting a detected cyberthreat comprising: receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; transmitting the request and the one or more IOCs to an analyst device; receiving a verification indication from the analyst device; and reporting the verified request and the one or more IOCs to a disruption network, wherein reporting the verified request and the one or more IOCs to the disruption network comprises providing access to one or more members of the disruption network to pull the request and the one or more IOCs via an application programming interface (API). ### Claim 2 (depends on 1) The method of claim 1, wherein the disruption network comprises a plurality of Internet providers and at least one of a domain registrar, a hosting platform, a domain name system (DNS) provider, an email security service, a content delivery network (CDN), or a deny list. ### Claim 3 (depends on 1) The method of claim 1, wherein identifying the one or more IOCs comprises identifying at least one of a social media account, a username of the social media account, an account ID of the social media account, a URL, a phishing kit, an author of the phishing kit, source code associated with the phishing kit, and one or more images. ### Claim 4 (depends on 1) The method of claim 1, wherein enriching the request comprises identifying at least one of a social network associated with the content, a geo-location associated with the content, a host associated with the content, a registrar associated with the content, an Internet Assigned Numbers Authority (IANA) ID associated with the content, an IP address associated with the content, an autonomous system number associated with the content, or a link shortener associated with the content. ### Claim 5 (depends on 1) The method of claim 1, wherein reporting the verified request and the one or more IOCs to the disruption network comprises: transmitting a first report to the disruption network, the first report comprising the verified request and the one or more IOCs; obtaining one or more additional IOCs in a subsequent 24-hour time period; and transmitting a second report to the disruption network, the second report comprising the verified request, the one or more IOCs, and the one or more additional IOCs. ### Claim 6 (depends on 1) The method of claim 1 further comprising performing a live scan of the content to determine whether the content is active. ### Claim 7 (depends on 6) The method of claim 6, wherein performing the live scan comprises at least one of: scanning a webpage associated with the content to identify a change of a removal of the content; scanning a webpage or a service for a service response; or monitoring an extensive provisional protocol (EPP) status of a domain associated with the content. ### Claim 8 (depends on 1) The method of claim 1 further comprising capturing feedback associated with the report to the disruption network, the capturing comprising at least one of: determining, via a browser driver, if any of the one or more IOCs is indicated as being malicious; determining, via querying a DNS server, if any of the one or more IOCs is blocked; or determining, via an email security provider, if any of the one or more IOCs is indicated as being malicious. ### Claim 9 A non-transitory computer-readable medium having instructions stored thereon for execution by a server to implement a method for disrupting a detected cyberthreat, the method comprising the steps of: receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; transmitting the request and the one or more IOCs to an analyst device; receiving a verification indication from the analyst device; and reporting the verified request and the one or more IOCs to a third-party, wherein reporting the verified request and the one or more IOCs to the third-party comprises: identifying an entity associated with the request: identifying a format associated with the entity; transforming the one or more IOCs based on the format; and transmitting the transformed one or more IOCs and the request to the entity. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein verifying the request comprises: transmitting the request and the one or more IOCs to an analyst device; and receiving a verification indication from the analyst device. ### Claim 11 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein identifying the one or more IOCs comprises identifying at least one of a social media account, a username of the social media account, an account ID of the social media account, a URL, a phishing kit, an author of the phishing kit, source code associated with the phishing kit, and one or more images. ### Claim 12 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein enriching the request comprises identifying at least one of a social network associated with the content, a geo-location associated with the content, a host associated with the content, a registrar associated with the content, an Internet Assigned Numbers Authority (IANA) ID associated with the content, an IP address associated with the content, an autonomous system number associated with the content, or a link shortener associated with the content. ### Claim 13 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the method further comprises performing a live scan of the content to determine whether the content is active. ### Claim 14 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein performing the live scan comprises at least one of: scanning a webpage associated with the content to identify a change of a removal of the content; scanning a webpage or a service for a service response; or monitoring an extensive provisional protocol (EPP) status of a domain associated with the content. ### Claim 15 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the method further comprises capturing feedback associated with the reporting, the capturing comprising at least one of: determining, via a browser driver, if any of the one or more IOCs is indicated as being malicious; determining, via querying a DNS server, if any of the one or more IOCs is blocked; or determining, via an email security provider, if any of the one or more IOCs is indicated as being malicious. ### Claim 16 A system for disrupting a detected cyberthreat, the system comprising a server, the server comprising a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform a method operable to: receive a request, the request identifying suspected malicious content; identify one or more indicators of compromise (IOCs) associated with the content; enrich the request with the IOCs; verify the request; and report the verified request and the one or more IOCs to a third-party, wherein reporting the verified request and the one or more IOCs to the third-party comprises: transmitting a first report to the third-party, the first report comprising the verified request and the one or more IOCs; obtaining one or more additional IOCs in a subsequent 24-hour time period; and transmitting a second report to the third-party, the second report comprising the verified request, the one or more IOCs, and the one or more additional IOCs. ### Claim 17 (depends on 16) The system of claim 16 wherein reporting the verified request and the one or more IOCs to the third-party comprises: identifying an entity associated with the request; identifying a format associated with the entity; transforming the one or more IOCs based on the format; and transmitting the transformed one or more IOCs and the request to the entity. ### Claim 18 (depends on 16) The system of claim 16 wherein the server is further configured to capture feedback associated with the reporting, the capturing comprising at least one of: determining, via a browser driver, if any of the one or more IOCs is indicated as being malicious; determining, via querying a DNS server, if any of the one or more IOCs is blocked; or determining, via an email security provider, if any of the one or more IOCs is indicated as being malicious.