eSentire MDR for Log provides 24/7 active log monitoring to deliver critical visibility, compliance and a system of record, across your multi-cloud and hybrid environments. We aggregate actionable intelligence from multi-signal ingestion to accelerate our investigations and deliver complete response.

Machine Learning Innovation: Malkara

Developed by the Threat Response Unit

With more employees working remotely than ever before, most organizations use VPNs or similar network access mechanisms to facilitate remote access. This presents an opportunity for attackers with valid account credentials to leverage your VPNs or network gateways to “walk in the front door” of your network undetected. The MITRE ATT&CK Framework classifies this technique as T1078 – Valid Accounts and it’s typically one of the more difficult techniques to identify before it’s too late.

To take on this challenge, the eSentire TRU team developed a proprietary machine learning model code-named Malkara as part of eSentire’s MDR for Log service. This tool leverages VPN log data and applies ML models to identify malicious VPN behaviors across cloud and on-premises environments using valid account credentials. Our 24/7 SOC Cyber Analysts follow investigative runbooks to determine the validity of the event and if the activity is determined to be malicious, take action available to them to contain the threat.