Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Beyond the first-order health effects of the COVID-19 and the second-order impact on the social and economic environment, the global pandemic has forced upon companies and other organizations a degree of technical and operational change—in terms of the combined might of scope and suddenness—that is without equal.
Workforce shifts to home workstations and the rapid migration to (or accelerated introduction of) more cloud services in support of that shift have altered threat surfaces. In parallel, this shift has disrupted processes and changed the working environments for many.
We recently teamed up with our partner VMware Carbon Black to investigate the impact that these changes have had on how threat actors operate. You can find the full results of this investigation in Threat Intelligence Spotlight: Hunting Evasive Malware, but in this post we’ll focus on one clear observation.
Threat actors, showing their usual agility, have shifted efforts to target remote workers and take advantage of current events. Because today’s networks have more sophisticated automated defenses than ever before, attackers are turning to:
When used in combination, as is frequently the case, these techniques are effective at bypassing automated defenses to gain initial access. In fact, the majority of successful bypass incidents eSentire observes result from these tactics. In the first half of 2020, eSentire observed Zloader, Valak, SocGholish and More_eggs successfully employing user exploitation and LOLBin abuse to gain initial access (the report examines a few examples in some detail).
Customizable behavioral rules, macro controls and macro signing provide some defenses. However, the challenge in developing automated defenses against user execution and LOLBins is that these activities in isolation do not indicate intent. It is only when considering the larger context of the action or execution that the malicious intention becomes clear.
That is why threat hunting is so important. Through continuous and collaborative research, threat hunters can distinguish between legitimate and malicious use of tools and processes, which is a necessary precursor to defining automated methods that reliably detect endpoint threats.
Mark is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations.