Giacomo Lanzi
Use cases of a SOCaaS for companies part 2
Estimated reading time: 5 minutes
In the previous article we have seen the most common use cases of a SOCaaS , explaining how it can be useful for companies to use this tool to prevent cyber attacks and also explaining which are the most common Threat Models .
In this article, however, we will take a closer look at some of the more common indicators of compromise (IOC). First we will briefly look at the malware threat models that the use of a SOCaaS can prevent and block. As it works, a SOCaaS can be very flexible and analyze a lot of data at the same time, thus providing in-depth and accurate results.
Malware Threat Models
It is important to know how to distinguish and classify the different types of malware to understand how they can infect systems and devices, the level of threat they represent and how to protect against them. We at SOD recommend adopting the use of a SOCaaS in order to be able to classify the entire range of malware or potentially unwanted objects. Malware is categorized based on the activity they perform on infected systems.
Wannacry Malware Detection
Thanks to this threat model it is possible to detect the behavior of the well-known malware Wannacry.
Wannacry malware is a ransomware that attacks the system by encrypting files of particular importance to an organization in order to make them illegible.
Early detection of ransomware is probably the most effective action you can take to defend yourself. There are also services that are able to block the action of the malware and restore any files already encrypted with those of a backup, for example Acronis Cyber Protect Cloud .
Network anomaly followed by data infiltration
Identifies successful network data aggregation attempts, followed by signs of data infiltration. Below we see some of the anomalies and how the use of a SOCaaS can identify important clues to counter threats.
During a network scan you may notice enumerations of AD accounts and privileges, count of LDAP services outside the corporate network and a suspicious number of ticket requests to Kerberos protocol . In addition, other indicators can be a spike in LDAP traffic and the enumeration of SMB services.
As regards the anomalies of the network drive , the use of a SOCaaS is able to control access to the sharepoint in order to identify an unusual number of accesses to shared elements. This also in relation to users and their level of access.
In terms of Data Aggregation and data infiltration, the quantity of bytes downloaded from the server ports and via FTP protocols are monitored, as well as an unusual quantity of bytes transmitted to the external.
Petrwrap / Goldeneye / Amalware detection
This threat model aims to detect malware Petrwrap . The use of a SOCaaS can detect network scanning activity by monitoring the number of SMBv1 activities, as well as anomalies in these activities. Attempting to reach a never-before-reached host may also be an indicator.
Another way in which these threats can be detected with the use of SOCaaS is by auditing of suspicious privileged activity. For example, it is verified that there is no escaletion of privileges, unusual access to an admin zone or even tampering with log files.
Risk indicators in general
Risk indicators are metrics used to show that the organization is subject to or has a high probability of being subject to a risk.
These indicators are used to classify the type of behavior or threat for a policy and can be used in multiple policies for different functionality based on the data source. Risk indicators can be chained with threat models to identify sophisticated attacks across multiple data sources.
In essence, these are clues or alarm bells that indicate events that a company’s security operators should pay particular attention to. The use of a SOCaaS can help identify these clues by analyzing large amounts of data and logs in a short time.
Below is a non-exhaustive list of some of the most common threat indicators that are identifiable through the use of a SOCaaS. We will divide them into different areas, for clarity.
As for accounts, obviously, blocking an account is an alarm bell, as well as an unusual number of accounts created or a disproportionate number of failed authentication. Finally, the use of a SOCaaS could indicate an IOC as a suspicious number of accounts running concurrently .
Access
The anomalies concerning the access or in any case the account include the detection of access to the anomalous administrative sherepoint but also the loading times of the anomalous applications. Applications that use an unusual amount of memory may also be indicators of compromise.
As for accounts, obviously, blocking an account is an alarm bell, as well as an unusual number of accounts created or a disproportionate number of failed authentication. Finally, the use of a SOCaaS could indicate an IOC as a suspicious number of accounts running concurrently .
Networks
Network alarm bells are, of course, the most common. Since networks are like “roads” of a corporate infrastructure, it is normal that anomalous behaviors in these are particularly relevant.
Common indicators are abnormal DNS zone transfers or failed requests to the firewall. But also an abnormal number of running hosts or ICMP connections. Traffic in general is also controlled through the use of SOCaaS, so that any suspicious data movement is analyzed or otherwise verified. Examples of this are packet movements to critical ports, RDP, SSH, or connection attempts to a DHCP server. These events often indicate abnormal attempts to connect to objects or network shares.
Through the use of a SOCaaS it is also very simple to control the behavior of the accounts that often show alarm bells in themselves . For example, an account logging into a host for the first time, creating an account, or adding privileges.
Conclusions
Relying on luck to catch threats is madness , as demonstrated by SolarWinds attack .
Create your luck with our SOCaaS solution , making sure you spot threats before incidents happen and that you are “lucky” enough to counter them.
Contact us to find out how our services can strengthen your company’s defenses, we will be happy to answer any questions.
Useful links:
Share
RSS
More Articles…
- From Secure Online Desktop to Cyberfero: rebranding of the leading cybersecurity company
- NIS: what it is and how it protects cybersecurity
- Advanced persistent threats (APTs): what they are and how to defend yourself
- Penetration Testing and MFA: A Dual Strategy to Maximize Security
- Penetration Testing: Where to Strike to Protect Your IT Network
- Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer.
- Why IT audit and log management are important for Cybersecurity
- Red Team, Blue Team and Purple Team: what are the differences?
Categories …
- Backup as a Service (18)
- Acronis Cloud Backup (11)
- Veeam Cloud Connect (4)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- Cyberfero (15)
- ICT Monitoring (5)
- Log Management (2)
- News (25)
- ownCloud (4)
- Privacy (7)
- Security (203)
- Cyber Threat Intelligence (CTI) (8)
- Deception (4)
- Ethical Phishing (11)
- Netwrix Auditor (2)
- Penetration Test (11)
- Posture Guard (3)
- SOCaaS (65)
- Vulnerabilities (84)
- Web Hosting (15)
Tags
darkreading
- It's Near-Unanimous: AI, ML Make the SOC Better November 20, 2024Efficiency is the name of the game for the security operations center — and 91% of cybersecurity pros say artificial intelligence and machine learning are winning that game.
- China's 'Liminal Panda' APT Attacks Telcos, Steals Phone Data November 20, 2024In US Senate testimony, a CrowdStrike exec explained how this advanced persistent threat penetrated telcos in Asia and Africa, gathering SMS messages, unique identifiers, and other metadata along the way.
- Alleged Ford 'Breach' Encompasses Auto Dealer Info November 20, 2024Cybersecurity investigators found the leaked data to be information from a third party, not Ford itself, that is already accessible to the public and not sensitive in nature.
- Apple Urgently Patches Actively Exploited Zero-Days November 20, 2024Though information regarding the exploits is limited, the company did report that Intel-based Mac systems have been targeted by cybercriminals looking to exploit CVE-2024-44308 and CVE-2024-44309.
- Small US Cyber Agencies Are Underfunded & That's a Problem November 20, 2024If the US wants to maintain its lead in cybersecurity, it needs to make the tough funding decisions that are demanded of it.
- 'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse November 20, 2024An elusive, sophisticated cybercriminal group has used known and zero-day vulnerabilities to compromise more than 20,000 SOHO routers and other IoT devices so far, and then puts them up for sale on a residential proxy marketplace for state-sponsored cyber-espionage actors and others to use.
- African Reliance on Foreign Suppliers Boosts Insecurity Concerns November 20, 2024Recent backdoor implants and cyber-espionage attacks on their supply chains have African organizations looking to diversify beyond Chinese, American tech vendors.
- DeepTempo Launches AI-Based Security App for Snowflake November 20, 2024DeepTempo's Tempo is a deep learning-based Snowflake native app that allows organizations to detect and respond to evolving threats directly within their Snowflake environments.
- RIIG Launches With Risk Intelligence Solutions November 20, 2024RIIG is a risk intelligence and cybersecurity solutions provider offering open source intelligence solutions designed for zero-trust environments.
- SWEEPS Educational Initiative Offers Application Security Training November 20, 2024The secure coding curriculum, funded by a $2.5 million grant, is available for students and professionals at all stages of their careers.
Full Disclosure
- SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) November 13, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Nov 12SEC Consult Vulnerability Lab Security Advisory < 20241112-0 > ======================================================================= title: Multiple vulnerabilities product: Siemens Energy Omnivise T3000 vulnerable version: >=8.2 SP3 fixed version: see solution section CVE number: CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879 impact: High...
- Security issue in the TX Text Control .NET Server for ASP.NET. November 13, 2024Posted by Filip Palian on Nov 12Hej, Let's keep it short ... ===== Intro ===== A "sudo make me a sandwich" security issue has been identified in the TX Text Control .NET Server for ASP.NET[1]. According to the vendor[2], "the most powerful, MS Word compatible document editor that runs in all browsers". Likely all versions […]
- SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater November 10, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Nov 09SEC Consult Vulnerability Lab Security Advisory < 20241107-0 > ======================================================================= title: Multiple Vulnerabilities product: HASOMED Elefant and Elefant Software Updater vulnerable version:
- Unsafe eval() in TestRail CLI November 7, 2024Posted by Devin Cook on Nov 06This is not a very exciting vulnerability, but I had already publicly disclosed it on GitHub at the request of the vendor. Since that report has disappeared, the link I had provided to MITRE was invalid, so here it is again. -Devin --- # Unsafe `eval()` in TestRail CLI […]
- 4 vulnerabilities in ibmsecurity November 3, 2024Posted by Pierre Kim on Nov 03## Advisory Information Title: 4 vulnerabilities in ibmsecurity Advisory URL: https://pierrekim.github.io/advisories/2024-ibmsecurity.txt Blog URL: https://pierrekim.github.io/blog/2024-11-01-ibmsecurity-4-vulnerabilities.html Date published: 2024-11-01 Vendors contacted: IBM Release mode: Released CVE: CVE-2024-31871, CVE-2024-31872, CVE-2024-31873, CVE-2024-31874 ## Product description ## Vulnerability Summary Vulnerable versions:...
- 32 vulnerabilities in IBM Security Verify Access November 3, 2024Posted by Pierre Kim on Nov 03## Advisory Information Title: 32 vulnerabilities in IBM Security Verify Access Advisory URL: https://pierrekim.github.io/advisories/2024-ibm-security-verify-access.txt Blog URL: https://pierrekim.github.io/blog/2024-11-01-ibm-security-verify-access-32-vulnerabilities.html Date published: 2024-11-01 Vendors contacted: IBM Release mode: Released CVE: CVE-2022-2068, CVE-2023-30997, CVE-2023-30998, CVE-2023-31001, CVE-2023-31004, CVE-2023-31005,...
- xlibre Xnest security advisory & bugfix releases October 31, 2024Posted by Enrico Weigelt, metux IT consult on Oct 31XLibre project security advisory --------------------------------- As Xlibre Xnest is based on Xorg, it is affected by some security issues which recently became known in Xorg: CVE-2024-9632: can be triggered by providing a modified bitmap to the X.Org server. CVE-2024-9632: Heap-based buffer overflow privilege escalation in _XkbSetCompatMap […]
- APPLE-SA-10-29-2024-1 Safari 18.1 October 31, 2024Posted by Apple Product Security via Fulldisclosure on Oct 31APPLE-SA-10-29-2024-1 Safari 18.1 Safari 18.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121571. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Downloads Available for: macOS Ventura and macOS Sonoma Impact: An […]
- SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) October 31, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 31SEC Consult Vulnerability Lab Security Advisory < 20241030-0 > ======================================================================= title: Query Filter Injection product: Ping Identity PingIDM (formerly known as ForgeRock Identity Management) vulnerable version: v7.0.0 - v7.5.0 (and older unsupported versions) fixed version: various patches; v8.0 CVE number:...
- SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) October 29, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 28SEC Consult Vulnerability Lab Security Advisory < 20241023-0 > ======================================================================= title: Authenticated Remote Code Execution product: Multiple Xerox printers (EC80xx, AltaLink, VersaLink, WorkCentre) vulnerable version: see vulnerable versions below fixed version: see solution section below CVE number: CVE-2024-6333...
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
{subscription_form_1}Products and Solutions
Partners
Cloud Models
News
- From Secure Online Desktop to Cyberfero: rebranding of the leading cybersecurity company May 6, 2024
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
Google Reviews
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2024 Cyberfero s.r.l. All Rights Reserved. Sede Legale: via Statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Cod. fiscale e P.IVA 03058120357 – R.E.A. 356650 Informativa Privacy - Certificazioni ISO