Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
Beyond the first-order health effects of the COVID-19 and the second-order impact on the social and economic environment, the global pandemic has forced upon companies and other organizations a degree of technical and operational change—in terms of the combined might of scope and suddenness—that is without equal.
Workforce shifts to home workstations and the rapid migration to (or accelerated introduction of) more cloud services in support of that shift have altered threat surfaces. In parallel, this shift has disrupted processes and changed the working environments for many.
We recently teamed up with our partner VMware Carbon Black to investigate the impact that these changes have had on how threat actors operate. You can find the full results of this investigation in Threat Intelligence Spotlight: Hunting Evasive Malware, but in this post we’ll focus on one clear observation.
Threat actors, showing their usual agility, have shifted efforts to target remote workers and take advantage of current events. Because today’s networks have more sophisticated automated defenses than ever before, attackers are turning to:
When used in combination, as is frequently the case, these techniques are effective at bypassing automated defenses to gain initial access. In fact, the majority of successful bypass incidents eSentire observes result from these tactics. In the first half of 2020, eSentire observed Zloader, Valak, SocGholish and More_eggs successfully employing user exploitation and LOLBin abuse to gain initial access (the report examines a few examples in some detail).
Customizable behavioral rules, macro controls and macro signing provide some defenses. However, the challenge in developing automated defenses against user execution and LOLBins is that these activities in isolation do not indicate intent. It is only when considering the larger context of the action or execution that the malicious intention becomes clear.
That is why threat hunting is so important. Through continuous and collaborative research, threat hunters can distinguish between legitimate and malicious use of tools and processes, which is a necessary precursor to defining automated methods that reliably detect endpoint threats.
Get notified of the latest news, intel and helpful tools & assets. You can unsubscribe anytime.
eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.