active adversary playbook – Computer Security Articles

Credit to Author: Angela Gunn| Date: Tue, 25 Apr 2023 10:00:03 +0000

A deep dive into over 150 incident-response cases reveals both attackers and defenders picking up the pace

Security Sophos

April 19, 2023 admin

‘AuKill’ EDR killer malware abuses Process Explorer driver

Credit to Author: Andrew Brandt| Date: Wed, 19 Apr 2023 10:00:43 +0000

Driver based attacks against security products are on the rise

Security Sophos

August 10, 2022 admin

Lockbit, Hive, and BlackCat attack automotive supplier in triple ransomware attack

Credit to Author: Matt Wixey| Date: Wed, 10 Aug 2022 11:00:50 +0000

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups. 3 attackers, 2 weeks – 1 entry point.

Security Sophos

August 9, 2022 admin

Multiple attackers increase pressure on victims, complicate incident response

Credit to Author: Matt Wixey| Date: Tue, 09 Aug 2022 11:00:04 +0000

Sophos’ latest Active Adversary report explores the issue of organizations being hit multiple times by attackers

Security Sophos

June 22, 2022 admin

Active Adversary Playbook 2022 Insights: Web Shells

Credit to Author: gallagherseanm| Date: Wed, 22 Jun 2022 11:00:07 +0000

Public proofs-of-concept of web shell exploits coincide with major spikes in attacks.

Security Sophos

June 7, 2022 admin

Move fast, unbreak things: About the Sophos Active Adversary Playbook 2022

Credit to Author: Angela Gunn| Date: Tue, 07 Jun 2022 11:16:50 +0000

Our latest report shows that the most pleasant way to learn from Rapid Response mayhem is to read about how it worked out for someone else