<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-watering-hole-analysis
description: >-
  Identify, analyze, and defend against watering hole attacks on websites frequented by target organizations.
domain: cybersecurity
subdomain: social-engineering
tags:
  - watering-hole
  - web-compromise
  - threat-analysis
  - social-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189"]
---

# Performing Watering Hole Analysis

## Overview

Identify, analyze, and defend against watering hole attacks on websites frequented by target organizations.

## Prerequisites

| Requirement | Install |
|---|---|
| Web proxy logs | Browsing data |
| Threat intelligence | IOC feeds |
| Python 3.10+ | For agent tooling |

## Key Concepts

Watering hole attacks compromise frequently visited websites.
Analysis covers browsing pattern profiling, website integrity
monitoring, exploit kit detection, and traffic anomalies.

## Quick Reference

```bash
node agent.js profile --department finance --days 90
node agent.js scan --url https://industry-news.example.com
node agent.js monitor --watchlist sites.txt --interval 3600
node agent.js analyze --pcap traffic.pcap --filter redirects
```

## Workflow

1. Profile browsing patterns
2. Build watchlist
3. Establish baselines
4. Monitor for injected scripts
5. Analyze traffic
6. Correlate with threat intel
7. Implement browser isolation

## Verification

- Verify profile captures destinations
- Confirm monitoring detects JS injection
- Validate alerting on deviations
- Check threat intel matches
- Verify isolation policy

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
