Detecting and Remediating Threats with EDR

Introduction

Adversaries are getting faster at breaching networks and many of today’s security products struggle to keep up with outdated approaches, limited visibility, and are complex and hard to operate.

CrowdStrike’s pioneering Endpoint Security capabilities provide industry-leading prevention, detection, investigation and response to stop breaches, faster.

Our single agent, unified platform delivers up to 75% faster responses with a 6x reduction in security consoles and agents.

Let’s see how it stops an active attack.

Walkthrough

A user sits down at his desk and sees a new email in his inbox. It looks like good news since it’s an email letting him know that he’s just been granted additional stock and all he needs to do is to sign the letter and email it back.

Obviously, he’s excited and opens the attached document, which looks innocent enough.

But, what’s actually happening in the background is that it’s establishing a connection to a command and control server hosted by a malicious actor.

We can see it making the connection here.

Now that the adversary has full control of the system, he can continue his attack to fulfill his objectives, be that exfiltrating data, moving laterally, or launching other payloads.

Now, taking a look at the CrowdStrike console, we can see all the detections that CrowdStrike has identified. And here’s the phishing attack we had witnessed earlier.

When CrowdStrike detects an attack, it doesn’t just simply show the file that was blocked. It shows the entire process tree and allows any security investigators to find the origins of the attack.

We can see Outlook had launched a word document which had subsequently launched a few powershell scripts.

We can even see the adversary try to cover their tracks by injecting their process into a notepad.exe.

I also do just want to point out that CrowdStrike could have just blocked the entire attack right away, but that would make for a really short demo. We put it into detect only mode so that we can see the fully captured actions of the adversary.

And here we can also see some commands that were executed after the connection was established.

With the system contained and the immediate danger averted, let’s continue our investigation.

We can see that the adversary also launched an executable file called Paryroll.exe. As we examine the details, we can see that it was quarantined and blocked.

CrowdStrike tracks over 200 malicious actors around the world and is able to attribute detections to an actor based on their attack profile.

This adversary focused threat intelligence allows us to better identify attacks and allows you to preemptively deploy countermeasures to stop breaches of your network.

Now under the kill chain tab, this also allows us to see the tradecraft that have been historically used by this actor in their previous attacks.

This shows us things like the malicious services that they use, their crimes as an ecrime organization, their tradecraft, as well as any exploit that they leverage.

These links are actual vulnerabilities that they have used in the past and are currently present in the environment.

If I click on one of these vulnerabilities, it’ll bring me to its current status. It’ll also show me an Exprt ai rating, which uses an AI to determine how critical that vulnerability is based on its prevalence and impact.

This enables you to better understand how critical it is to patch a vulnerability since it also takes into account if the vulnerability is being leveraged out in the wild.

Conclusion

At the heart of every cyber attack is a motivated individual or group looking to achieve their objectives, whether it be financial gain or a political statement.

CrowdStrike’s ability to leverage advanced AI to detect and block threats allows you to stop the adversaries in their tracks and prevent breaches.