Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
eSentire will be a sponsor at the Seattle CyberSecurity Conference.
eSentire will be a Sponsor at the NetDiligence Cyber Risk Summit in…
eSentire will be presenting and is a Gold Sponsor at the CyberRisk…
DOWNLOAD NOW:
PlugX Trojan
Non-profit research organization
A cyberattack can compromise systems that drive an organization’s operations and expose sensitive data. Financial institutions are obvious targets, but opportunistic cybercriminals will target organizations they suspect do not have banking-level security. In this case, a non-profit research organization was unaware a PlugX trojan had invaded its network and had been present for more than six years. Fortunately, eSentire’s Security Operation Center (SOC), leveraging MDR for Network and MDR for Endpoint, quickly detected the threat actor’s presence during a proof of concept exercise.
eSentire was conducting a proof of concept (POC) with a potential customer. We installed an eSentire MDR for Network sensor, which immediately triggered an alert in our Security Operations Center (SOC) for a Command and Control check in for a PlugX trojan. Based on this, eSentire received permission from the customer to install an endpoint sensor on the machine that triggered the alert of a PlugX trojan, a remote access tool (RAT) that uses modular plugins. It is a common tool used by multiple threat groups because it is complex and often evades typical security measures.
Investigation revealed that legitimate antivirus (AV) software had been used to install the malicious trojan without being detected by the AV, through a technique called dll hijacking. The trojan had a lot of complexity and encryption, so that it did not appear malicious. It included a “do not execute until 2013” time code, revealing that the machine had been infected for several years. Decrypting this was no easy task.
The trojan initially loads a dll that is a simple launcher. It looks for an encrypted, hidden “stage-one” payload, which then launches a “stage-two” payload, also hidden, encrypted and compressed. When unpacked, it launches the final, malicious dll file containing the trojan. Investigation showed two functionalities for the final payload: periodic screenshots of the infected machine and a keystroke logger. There was no evidence of any screenshots to be found. But, we decrypted a 30mb file of keystroke data with timestamps going back to 2014.
eSentire isolated the affected machine when we installed the endpoint sensor. It is unknown when the initial infection occurred because there was no sensor on the endpoint to collect telemetry. The malware had a network channel back to the attacker, but we had no way to prove what they saw. Luckily, what we were able to find in the 30mb file was not the company’s critical data. The customer had an IT security company monitoring their network and they detected nothing for five-plus years. During the eSentire POC, eSentire detected, isolated, investigated and removed the longstanding threat in less than two weeks.
Connect with an eSentire Security Specialist to learn how we can help you build a more resilient security operation and prevent disruption.