eSentire Security Teams Respond to Interactive Intrusion

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• An attacker accessed a customer’s network via the corporate VPN using stolen credentials.
• The attacker deployed Cobalt Strike beacons across network assets using legitimate administrative credentials.
• Next, the attacker proxied command & control traffic through the VPN beachhead to evade network monitoring.
• Lastly, the attacker conducted precursor activity to ransomware, including domain reconnaissance, enumeration of network assets and attempts to compromise domain controllers.

How did we find it?

• Our Machine Learning PowerShell classifier detected Cobalt Strike beacon activity.
• Our 24/7 SOC analysts used the available endpoint, network, and log telemetry to trace the beacon activity to compromised VPN accounts and scope the intrusion.

What did we do?

• Identified and contained multiple intrusion attempts over 24 hours, preventing the adversary from achieving their objectives.
• Isolated assets where Cobalt Strike beacons were identified.
• Implemented network disruption rules for command & control domains.
• Over the course of 24 hours, eSentire’s SOC team worked with the customer to reset their accounts, shut down malicious VPN sessions, and implement additional defensive measures.

What can you learn from this TRU positive?

• Remote access services are a common method for gaining access to environments, particularly when multi-factor authentication (MFA) is not enabled.
• An interactive attacker with privileged access to the network can be extremely difficult to eradicate, so continuous monitoring is needed post-identification to remove all access and prevent the adversary from re-establishing a foothold.

Recommendations from our Threat Response Unit (TRU) Team:

• Enable and enforce MFA on all remote access services, particularly VPN tools.
• Regularly scan your network assets for vulnerabilities, especially those which are remotely accessible.
• Employ an endpoint detection and response solution and monitor for common ransomware TTPs such as Cobalt Strike.
• Have an incident response plan in place specifically for modern ransomware. CISA provides a detailed guide for preparing and responding to these attacks.

Ask Yourself…

• What steps have you taken to defend and monitor for unauthorized access via remote access services such as VPN?
• Do you have the visibility necessary to identify compromised administrator-level accounts?
• Can you detect intrusion tools such as Cobalt Strike?
• Can you identify, contain, and eradicate an interactive intruder faster than they can achieve their objectives?

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.

Want to learn more? Connect with an eSentire Security Specialist.
 

ABOUT THE AUTHOR

eSentire Threat Intel Threat Intelligence Research Group