{"id":20692,"date":"2022-11-30T05:21:04","date_gmt":"2022-11-30T13:21:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/11\/30\/news-14425\/"},"modified":"2022-11-30T05:21:04","modified_gmt":"2022-11-30T13:21:04","slug":"news-14425","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/11\/30\/news-14425\/","title":{"rendered":"Detection Tools and Human Analysis Lead to a Security Non-Event"},"content":{"rendered":"

Credit to Author: Angela Gunn| Date: Wed, 30 Nov 2022 12:00:13 +0000<\/strong><\/p>\n

\n

A recent Sophos X-Ops case provides an example of how Managed Detection and Response (MDR) is more effective when tools talk to one another\u2026 and a team of analysts is listening in.<\/p>\n

The customer in this example is a large private telecommunications company. Our customer has an assortment of security systems from Sophos and other vendors in place, and now, with Sophos MDR, a way to tie them all together. \u00a0MDR watches for alert data not just from Sophos’ security products but also other vendors’ security products as well. As we see later, MDR analysts can take that data from multiple vendors’ sources and use it to analyze what’s happening in the customer’s environment.<\/p>\n

In this mid-October attack, the adversary spoofed a large European financial-services company. After obtaining several dozen email addresses for certain departments, the attackers sent our customer hundreds of Spearphishing Links (SL) messages \u2013 official-sounding attempts at getting recipients to click a link and, on a maliciously crafted web page, to type in their credentials or download a file. (SL is a popular variation on spearphishing; MITRE ATT&CK lists it as Technique T1566.002<\/a>.)<\/p>\n

In this case, the emails (two versions, same phish) claimed that the recipient was required to authenticate their identity on the site to which the email claimed to link \u2013 and that since they\u2019d already failed to do so earlier, their security was disabled until they clicked the link in the email. The customer\u2019s email appliance flagged both versions of the suspicious emails and modified the malicious links to protect users, then delivered 118 of the modified emails to users \u2013 two of whom clicked the link.\"\"<\/a>\"\"<\/a><\/p>\n

Figure 1: The phishing attempt, with an official look and tone<\/em><\/p>\n

A Google Translate English version of the lure<\/a> reads:<\/p>\n

In application of the 2nd European directive for payment services (Dsp2), strong authentication will be required of you every 90 days to access your accounts on our site.<\/p>\n

We inform you that your security is disabled, please enable it through the link below:<\/p>\n

This service is mandatory and is offered to you free of charge by [REDACTED].<\/p>\n

PASS-SECURITY<\/p>\n

**You risk a temporary ban on all your debit transactions by ignoring this notice**<\/p>\n

*If you are an administrator: Get the code on your portal<\/p>\n

Sogecash.net<\/p>\n

Best regards,<\/p>\n

 <\/p>\n

Sophos\u2019 MDR platform examined the flag from the appliance, which showed that 69 of the customer\u2019s email addresses received at least one instance of suspicious mail, with 234 alerts firing in total. MDR\u2019s automated processes evaluated the alerts, noted strong similarities, and clustered all 234 into two clustered events for deeper analysis.<\/p>\n

At this point, humans stepped in. Looking at the information communicated from the third-party appliance to the MDR platform, Sophos\u2019 analyst made note of various parameters including the subject header, time sent, purported sender, and the URL to which the emails pointed. The analyst also made note of the sender\u2019s actual IP address and two smallish files attached to the email, text.html and text.txt.<\/p>\n

With this information, our analyst was able to draw in further intelligence from multiple sources. Our first stop was a VirusTotal check on the IP address to which the email was directing recipients, an address we (and other security vendors) identify as malicious. Inside Sophos\u2019 own XDR, the analyst dug into the two attached files, checking the customer\u2019s network journals for traffic to the malicious URL and trawling the data lake to see if any process associated with the attack was successfully executed.<\/p>\n

The news was good: Our investigation confirmed that no malicious process had slipped through the firewall or lingered to trouble the network later, even though two users were confirmed to have clicked the (neutered) link. A quick alert to the customer laid out the initial flag and the ensuing deeper investigation and recommended that the customer delete the malicious emails still sitting in user inboxes.<\/p>\n

In the end, nothing bad happened — thanks to the combination of detection tools and human analysis as part of ongoing managed detection and response. Not only did this combination of defense capabilities prevent something bad from happening, it also enabled us and this customer to learn from the non-event, in order to better protect this customer and other customers \u2013 a view from sentries with an unprecedented view of the action.<\/p>\n<\/p><\/div>\n

http:\/\/feeds.feedburner.com\/sophos\/dgdY<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Angela Gunn| Date: Wed, 30 Nov 2022 12:00:13 +0000<\/strong><\/p>\n

A look at how MDR turned a targeted attack into a non-event, in which no high-value credentials are compromised and several dozen employees are not tricked into letting a bad guy get boots on the ground<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10377],"tags":[25038,27604,27030,11285,16771],"class_list":["post-20692","post","type-post","status-publish","format-standard","hentry","category-security","category-sophos","tag-mdr","tag-sophos-mdr","tag-sophos-x-ops","tag-spearphishing","tag-threat-research"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/20692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=20692"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/20692\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=20692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=20692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=20692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}