eSentire MDR for Endpoint goes beyond traditional managed endpoint protection. We safeguard your endpoints 24/7 by uncovering, isolating and remediating threats to prevent lateral spread.

Following initial intrusion, many attackers pivot to PowerShell as a means to advance their objectives. PowerShell commands are easily obfuscated, meaning it’s easy for an attacker to hide malicious commands within script that otherwise appear normal. Using this technique, attackers can evade detection from endpoint protection technologies.

eSentire’s TRU team created a proprietary application called BlueSteel to solve this problem. BlueSteel analyzes all PowerShell commands from customer endpoints and classifies them as either malicious or benign. The BlueSteel technique is similar to SPAM classification, utilizing frequency analysis with terms and characters to differentiate between good and bad. The goal is to increase the accuracy of PowerShell threat detection beyond what endpoint protection provides using machine learning.

As PowerShell attacks continue to be leveraged by attackers, BlueSteel continues to learn and enhance its threat detection capabilities. Combining machine learning with elite threat hunting and applying it to eSentire’s MDR capabilities, our Security Operation Center analysts are empowered to disrupt, contain and remediate threats like PowerShell every day.