Discover the latest news and innovations from Fal.Con Europe Learn more
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Endpoint Security in Action
Follow a Scattered Spider phishing attack from detection to response. See process tree analysis, Charlotte AI investigation, cross-domain correlation, and Real-Time Response containment.
[00:00]
[MUSIC PLAYING] CrowdStrike, endpoint security. CrowdStrike pioneered an adversary-focused approach to modern endpoint security. Our single agent, single console, and unified platform improves response times by 95%, with a six times reduction in security consoles and agents. The Falcon platform combines cutting-edge AI and world-class
[00:26]
threat intelligence with the real-world expertise of CrowdStrike's elite threat experts, whose combined insights create a feedback loop for continuous innovation. We've always said organizations don't have a malware problem. They have an adversary problem. Scattered Spider is a highly sophisticated e-crime adversary that leverages advanced social engineering attacks
[00:51]
and targets large organizations with ransomware. Let's see how the CrowdStrike platform stops these adversarial attacks in real time. When the malicious attachment is open in Microsoft Outlook, the adversary initiates a connection to their command and control server, enabling them to gain full control over the user's system. For the purpose of this demo, CrowdStrike has been configured in detect-only mode
[01:16]
to highlight the platform's visibility into the attack chain. In a real-world scenario, CrowdStrike's protection capabilities would have stopped this attack at its very inception, effectively blocking the threat before it could establish any foothold. The Falcon dashboard provides visibility into all adversary activity, prioritizing top threats across diverse operating systems. CrowdStrike automatically attributed the attack
[01:42]
to Scattered Spider using built-in threat intelligence. The platform identified them as the orchestrators of the phishing attack and flagged the detection. The process tree provides a detailed visualization of the attack trajectory, tracing its origin from Microsoft Outlook, following the adversary's use of PowerShell scripts, and highlighting all subsequent malicious activities. This enables swift and accurate investigations
[02:08]
with unparalleled clarity. Use Charlotte AI in your investigation to decode complex commands into clear step-by-step explanations, helping you quickly understand the intent and streamline responses. You get complete visibility into how each threat maps to the MITRE ATT&CK framework and a complete description of the attack. Initial malicious activity was detected on the endpoint by CrowdStrike endpoint security, showcasing its real-time
[02:36]
detection capabilities. To uncover the full scope and severity of the attack, CrowdStrike seamlessly integrates telemetry across multiple domains with the incident workbench, providing a clear view of how the various elements of the attack are interconnected across endpoint, identity, cloud, and more. CrowdStrike employees investigate with Charlotte AI to streamline incident analysis by translating
[03:03]
complex adversary activity into clear, actionable language. It also further enhances decision-making by suggesting relevant entities and context associated with the attack. Next, you can close the loop with native cross-domain response actions. For example, you can add a compromised identity to a watch list to enforce multi-factor authentication, or sever their connection to the command and control
[03:29]
server by containing the host, preventing further malicious action. Finally, you have the ability to remediate the issue with surgical precision by connecting to the host and executing commands directly on the endpoint, terminating the process that spawned the malicious file with a real-time response. The process has been terminated, containing the attack and stopping the breach.
[03:55]
Industry-leading security that's easy to deploy and operate, all while cutting complexity and cost. That's CrowdStrike. Contact us to learn how you can stop adversaries faster with CrowdStrike Endpoint Security.
[MUSIC PLAYING] CrowdStrike, endpoint security. CrowdStrike pioneered an adversary-focused approach to modern endpoint security. Our single agent, single console, and unified platform improves response times by 95%, with a six times reduction in security consoles and agents. The Falcon platform combines cutting-edge AI and world-class
[00:26]
threat intelligence with the real-world expertise of CrowdStrike's elite threat experts, whose combined insights create a feedback loop for continuous innovation. We've always said organizations don't have a malware problem. They have an adversary problem. Scattered Spider is a highly sophisticated e-crime adversary that leverages advanced social engineering attacks
[00:51]
and targets large organizations with ransomware. Let's see how the CrowdStrike platform stops these adversarial attacks in real time. When the malicious attachment is open in Microsoft Outlook, the adversary initiates a connection to their command and control server, enabling them to gain full control over the user's system. For the purpose of this demo, CrowdStrike has been configured in detect-only mode
[01:16]
to highlight the platform's visibility into the attack chain. In a real-world scenario, CrowdStrike's protection capabilities would have stopped this attack at its very inception, effectively blocking the threat before it could establish any foothold. The Falcon dashboard provides visibility into all adversary activity, prioritizing top threats across diverse operating systems. CrowdStrike automatically attributed the attack
[01:42]
to Scattered Spider using built-in threat intelligence. The platform identified them as the orchestrators of the phishing attack and flagged the detection. The process tree provides a detailed visualization of the attack trajectory, tracing its origin from Microsoft Outlook, following the adversary's use of PowerShell scripts, and highlighting all subsequent malicious activities. This enables swift and accurate investigations
[02:08]
with unparalleled clarity. Use Charlotte AI in your investigation to decode complex commands into clear step-by-step explanations, helping you quickly understand the intent and streamline responses. You get complete visibility into how each threat maps to the MITRE ATT&CK framework and a complete description of the attack. Initial malicious activity was detected on the endpoint by CrowdStrike endpoint security, showcasing its real-time
[02:36]
detection capabilities. To uncover the full scope and severity of the attack, CrowdStrike seamlessly integrates telemetry across multiple domains with the incident workbench, providing a clear view of how the various elements of the attack are interconnected across endpoint, identity, cloud, and more. CrowdStrike employees investigate with Charlotte AI to streamline incident analysis by translating
[03:03]
complex adversary activity into clear, actionable language. It also further enhances decision-making by suggesting relevant entities and context associated with the attack. Next, you can close the loop with native cross-domain response actions. For example, you can add a compromised identity to a watch list to enforce multi-factor authentication, or sever their connection to the command and control
[03:29]
server by containing the host, preventing further malicious action. Finally, you have the ability to remediate the issue with surgical precision by connecting to the host and executing commands directly on the endpoint, terminating the process that spawned the malicious file with a real-time response. The process has been terminated, containing the attack and stopping the breach.
[03:55]
Industry-leading security that's easy to deploy and operate, all while cutting complexity and cost. That's CrowdStrike. Contact us to learn how you can stop adversaries faster with CrowdStrike Endpoint Security.
