Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
THE THREAT (Executive Summary):
On December 8th, FireEye disclosed that they were the victim of a nation-state attack. During their investigation, they discovered that an attacker targeted and accessed certain Red Team assessment tools FireEye used to test their customers’ security. These tools mimic the behavior of known cyber threat actors and fortunately, this disclosure did not include tools to exploit zero-day vulnerabilities or unknown techniques.
FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.
What we’re doing about it:
What you should do about it:
Prioritized CVEs by FireEye:
CVE-2019-11510 - Pulse Secure SSL VPNs
CVE-2020-1472 - Microsoft Active Directory
CVE-2018-13379 - Fortinet Fortigate SSL VPN
CVE-2018-15961 - Adobe ColdFusion
CVE-2019-0604 - Microsoft SharePoint
CVE-2019-0708 - Windows Remote Desktop Services
CVE-2019-11580 - Atlassian Crowd
CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway
CVE-2020-10189 - ZoHo ManageEngine Desktop Central
CVE-2014-1812 - Windows
CVE-2019-3398 - Confluence
CVE-2020-0688 - Microsoft Exchange
CVE-2016-0167 - Microsoft Windows
CVE-2017-11774 - Microsoft Outlook
CVE-2018-8581 - Microsoft Exchange Server
CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus