incident response

Winsage
February 13, 2025
Microsoft has reported on the Russian state actor subgroup known as Seashell Blizzard, focusing on the "BadPilot campaign," which has been active since at least 2021. This campaign targets Internet-facing infrastructure to support broader operations, expanding its reach from Eastern Europe to a global scale. The subgroup has successfully infiltrated sensitive sectors like energy, telecommunications, arms manufacturing, and government entities, particularly exploiting vulnerabilities in software such as ConnectWise ScreenConnect and Fortinet FortiClient EMS since early 2024. Since the conflict in Ukraine began, there has been an increase in targeting international organizations significant to geopolitical interests, with at least three destructive cyberattacks attributed to this subgroup since 2023. The subgroup employs sophisticated cyber intrusion techniques, adapting its strategies to respond to evolving goals. Seashell Blizzard is linked to the Russian Military Intelligence Unit 74455 (GRU) and has been associated with various high-profile cyber incidents since its emergence in 2013. The subgroup's operations have evolved to include targets in the United States, Canada, and the United Kingdom, reflecting a strategic pivot to exploit vulnerabilities across different regions. The subgroup has demonstrated three primary exploitation patterns: deploying remote management and monitoring suites for persistence, using tunneling utilities to establish covert access, and modifying infrastructure to collect credentials. Organizations are advised to remain vigilant for indicators of compromise related to Seashell Blizzard's activities.
Winsage
December 27, 2024
Sophos has reported a 51% increase in the exploitation of "living off the land" binaries (LOLBins) since 2021, with an 83% rise over the past three years. In an analysis of nearly 200 incident response cases in the first half of 2024, 187 distinct Microsoft LOLBins were identified, with remote desktop protocol (RDP) being the most targeted, appearing in 89% of incidents. Compromised credentials are the leading cause of cyberattacks, responsible for 39% of incidents, despite a decrease from 56% in 2023. The LockBit ransomware group remains the most prevalent threat, accounting for 21% of infections. Additionally, 21% of compromised Active Directory servers were found to be operating beyond Microsoft’s mainstream support, making them more vulnerable. Sophos emphasizes the importance of proactive monitoring and regular system updates to mitigate these risks.
Tech Optimizer
December 18, 2024
Mattermost has entered a strategic partnership with pgEdge to integrate pgEdge Distributed PostgreSQL as a supported database for its collaboration platform. This collaboration aims to enhance Mattermost's platform with an ultra-high availability database solution, allowing organizations to achieve four nines or five nines of uptime. The integration supports deployment in on-premises environments or cloud accounts, including secure computing settings. The partnership has already led to collaboration with a U.S. Government agency requiring a consistently available collaboration platform. Mattermost is recognized for its secure collaboration tools for defense, security, and intelligence teams, while pgEdge is known for its fully distributed, open-source PostgreSQL database with multi-master replication technology.
Tech Optimizer
November 15, 2024
EventLogs are essential for Windows operating system forensics but have limitations in identifying suspicious activities, necessitating additional audit logs or tools like Sysmon. Event Tracing for Windows (ETW) is a significant feature that enhances Windows forensics by collecting and managing EventLogs. ETW consists of four components: Providers (which generate events), Consumers (which process events), Sessions (which relay events), and Controllers (which manage sessions). ETW logs a wide range of operating system behaviors, making it valuable for forensic investigators. Notable ETW providers for incident investigation include Microsoft-Windows-Threat-Intelligence, Microsoft-Windows-DNS-Client, Microsoft-Antimalware-AMFilter, Microsoft-Windows-Shell-Core, Microsoft-Windows-Kernel-Process, and Microsoft-Windows-Kernel-File. Some ETW events are saved as files, while others are accessed in real-time from buffers, allowing for the recovery of information even if ETL files are deleted. JPCert has developed an ETW Scanner plugin for Volatility to extract ETW events from memory images, aiding incident response. The LwtNetLog ETW session collects network-related data, helping investigators identify malware communication and other activities. ETW's detailed logging capabilities and tools like the ETW Scanner enhance the ability to detect threats that traditional logging methods may miss.
Winsage
October 24, 2024
Windows administrators are adapting to changes in security practices due to the rise of sophisticated cyber threats, increased remote work, cloud adoption, regulatory compliance, and supply chain attacks. Key strategies discussed include the integration of advanced threat protection tools, prioritizing endpoint security and zero-trust principles, extending security strategies to cloud environments, implementing strong data protection measures, and enhancing third-party security. The Crowdstrike incident highlighted the importance of change management, continuous monitoring, a layered security approach, proactive communication, disaster recovery planning, vendor accountability, regular security audits, and incident response readiness. AI's role in Windows security is evolving, with potential benefits in threat detection and response, but it also introduces new vulnerabilities and requires adherence to data privacy standards. Organizations must implement governance practices to mitigate risks associated with AI manipulation, ensure human oversight, navigate regulatory considerations, and build user trust for successful adoption.
Tech Optimizer
October 22, 2024
Kaseya's 2024 Cybersecurity Survey Report highlights that 89% of IT professionals view human behavior as the primary threat to cybersecurity. Phishing scams impact 58% of businesses surveyed, while ransomware payouts have declined to 11% due to increased investments in backup and recovery technologies. Over 80% of respondents expect their IT security budgets to remain stable or grow, with planned investments in cloud security, automated penetration testing, and security awareness training. The survey indicates a rise in cyber insurance adoption, increasing from 27% to 61% in 2024. The sample primarily includes companies from North America, with a focus on those with annual revenues between USD million and USD million and employing 101 to 500 individuals.
Tech Optimizer
September 18, 2024
ServiceNow is transitioning from MariaDB to RaptorDB, a database built on open-source PostgreSQL technology, with the upcoming "Xanadu" release. This change aims to enhance performance, with RaptorDB offering a 53% improvement in overall transaction times, 27x faster report generation, and a 3x increase in transactional throughput. The Xanadu release introduces an integrated development environment (IDE) for Visual Studio Code, an AI coding assistant, and expanded generative AI capabilities tailored for various industries. Additionally, it features a new solution for retailers and enhancements for IT application portfolio management. A Knowledge Graph, designed to streamline data management and analytics, is expected to launch in March 2025 with the next major update, "Yokohama."
Tech Optimizer
September 3, 2024
Businesses must protect their Windows devices from various cybersecurity threats, including malware, phishing attacks, and compromised cloud applications. Many antivirus providers now offer comprehensive endpoint protection to tackle these challenges. The comparison evaluates six leading antivirus options for Windows 10 and 11, focusing on core features, pricing, and overall safety: 1. Bitdefender GravityZone: - Pricing: .49/year for 10 devices (Small Business Security); .99/year (Business Security); .49/year (Business Security Premium). - Features: Ransomware prevention, protection against fileless attacks, advanced anti-phishing, network intrusion prevention, web content control, sandbox analyzer. - Pros: Comprehensive features, affordable pricing, detects fileless malware. - Cons: High memory usage, does not support secondary antivirus software. 2. ESET PROTECT: - Pricing: /year (Protect Entry); /year (Protect Advanced); .45/year (Protect Complete). - Features: Network intrusion prevention, mobile threat defense, full disk encryption, automatic vulnerability remediation. - Pros: Multi-layered defense, lightweight agents. - Cons: Higher pricing compared to other options. 3. Malwarebytes ThreatDown: - Pricing: [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: In the ever-evolving landscape of cybersecurity, businesses must prioritize the protection of their Windows devices from a multitude of threats, including malware such as viruses, spyware, and trojans. However, the spectrum of risks extends beyond malware, encompassing phishing attacks, malicious websites, and compromised cloud applications. To combat these challenges, many antivirus providers have expanded their offerings to include comprehensive endpoint protection capabilities, addressing advanced threats that can jeopardize business integrity. Top Windows antivirus software comparison Each antivirus solution featured here not only safeguards endpoints like laptops and desktops but also enhances security through features such as intrusion prevention and control over unauthorized peripheral devices. This comparison evaluates six leading antivirus options for Windows 10 and 11, focusing on core features, pricing, and overall safety. Bitdefender GravityZone: Best overall Bitdefender has garnered acclaim for its free antivirus offerings, yet its business solutions, particularly the GravityZone platform, provide exceptional value. This platform is designed to deliver advanced endpoint protection against ransomware, phishing sites, and real-time exploits in widely used applications like browsers and Microsoft Office. Enhanced plans introduce features such as web control, attack forensics, and a sandbox environment for testing suspicious files. Why I chose Bitdefender GravityZone Bitdefender strikes a commendable balance between affordability and robust security features, earning a positive reputation for user data privacy. Its comprehensive suite is well-suited for businesses seeking effective protection without breaking the bank. Pricing GravityZone Small Business Security: 9.49 per year for 10 devices, offering anti-phishing and ransomware protection. GravityZone Business Security: 8.99 per year for 10 devices, adding network-based attack protection and analytics. GravityZone Business Security Premium: 0.49 per year for 10 devices, featuring machine learning detection and Microsoft Exchange anti-spam. Features Ransomware prevention and decryption. Protection against fileless attacks. Advanced anti-phishing capabilities. Network intrusion prevention. Web content control and filtering. Sandbox analyzer for suspicious files. Pros and cons Pros Cons Comprehensive feature portfolio. Affordable pricing. Detects fileless malware. Post-attack forensic capabilities. High memory usage. Does not support secondary antivirus software. ESET PROTECT: Best for multi-layered protection ESET PROTECT stands out as a robust antivirus solution catering to Windows 10 and 11 endpoints, as well as mobile devices and cloud applications. Although its pricing is on the higher side, the multi-layered security controls, including encryption solutions and patch management, are impressive. Why I chose ESET PROTECT This platform provides a comprehensive security framework that can encompass an organization’s entire IT environment, making it ideal for businesses with complex security requirements. Pricing Protect Entry: 2 per year for 10 devices. Protect Advanced: 0 per year for 10 devices, adding mobile threat defense and full disk encryption. Protect Complete: 5.45 per year for 10 devices, including vulnerability management and cloud app protection. Features Network intrusion prevention. Mobile threat defense. Full disk encryption. Automatic vulnerability remediation. Pros and cons Pros Cons Multi-layered defense for endpoints and cloud apps. Lightweight agents minimize performance impact. Higher pricing compared to other options. Malwarebytes ThreatDown: Best managed detection and response Renowned for its on-demand scanning utility, Malwarebytes offers the ThreatDown platform, which features advanced capabilities such as automatic incident response and ransomware rollback. The managed threat hunting service provides businesses access to expert security resources. Why I chose Malwarebytes ThreatDown Despite its higher price point, Malwarebytes is celebrated for its detection accuracy and privacy standards, making it a valuable investment for businesses seeking robust managed services. Pricing Core: 0 per year for 10 devices. Advanced: 0 per year for 10 devices, adding ransomware rollback and endpoint detection. Elite: 0 per year for 10 devices, including full managed detection and response. Features Incident remediation and response. Application blocking and vulnerability assessment. Pros and cons Pros Cons Highly accurate malware detection. Includes ransomware mitigation utilities. Higher pricing compared to other options. Lacks intrusion prevention features. Avast: Best for small businesses Avast caters specifically to small businesses, offering features such as data loss prevention and a VPN service for secure browsing. However, recent controversies regarding user data sharing have affected its standing. Why I chose Avast Avast provides a well-rounded suite of security features at competitive pricing, making it a practical choice for small enterprises. Pricing Avast Small Office Protection: 9.99 per year for 10 devices. Avast Essential Business Security: 6.72 per year for 10 devices. Features Ransomware protection. Data loss prevention. Pros and cons Pros Cons Tailored for small businesses. Competitive pricing. Involved in a customer data sharing controversy. Trend Vision One from Trend Micro: Best for custom security bundles Trend Micro's Vision One solution allows businesses to create customized security bundles tailored to their specific needs. This flexibility is particularly beneficial for larger organizations with unique security profiles. Why I chose Trend Vision One The ability to mix and match security services offers businesses a tailored approach to cybersecurity, potentially reducing costs by only paying for necessary features. Pricing Trend Micro employs a credit-based pricing model, and potential customers are encouraged to contact sales for detailed pricing information. Features Behavioral analysis of endpoints. Data loss prevention. Pros and cons Pros Cons Customized security bundles. Pricing structure lacks transparency. McAfee: Best for beginners McAfee offers a range of affordable antivirus solutions tailored for families and small businesses. Its recent product updates have improved user experience and security. Why I chose McAfee Despite past criticisms, McAfee's current offerings are competitively priced and feature advanced privacy protections, making them suitable for startups and family-run businesses. Pricing McAfee+ Premium: .99 per year for unlimited devices. McAfee+ Advanced: 9.99 per year for unlimited devices. Features Text scam detector. Parental controls. Pros and cons Pros Cons Affordable pricing. Unlimited device installation. Limited to six individual users. How do I choose the best Windows antivirus for my business? Choosing the right antivirus solution involves balancing pricing with security needs. Larger companies in regulated sectors may require comprehensive solutions like Malwarebytes ThreatDown, while smaller businesses might find adequate protection in more budget-friendly options like McAfee or Avast. Bitdefender stands out as a well-rounded choice, offering a blend of features, pricing, and safety. Methodology The products selected for this comparison were chosen based on their unique business-focused features and positive customer feedback. Extensive research was conducted through product pages, datasheets, and trial versions, supplemented by insights from industry forums and publications to evaluate their safety and usability." max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"]/year (Core); /year (Advanced); 9/year (Elite). - Features: Incident remediation, application blocking, vulnerability assessment. - Pros: Highly accurate malware detection, includes ransomware mitigation. - Cons: Higher pricing, lacks intrusion prevention features. 4. Avast: - Pricing: .99/year (Small Office Protection); .72/year (Essential Business Security). - Features: Ransomware protection, data loss prevention. - Pros: Tailored for small businesses, competitive pricing. - Cons: Involved in a customer data sharing controversy. 5. Trend Vision One from Trend Micro: - Pricing: Credit-based pricing model, contact sales for details. - Features: Behavioral analysis, data loss prevention. - Pros: Customized security bundles. - Cons: Pricing structure lacks transparency. 6. McAfee: - Pricing: .99/year (McAfee+ Premium for unlimited devices); .99/year (McAfee+ Advanced for unlimited devices). - Features: Text scam detector, parental controls. - Pros: Affordable pricing, unlimited device installation. - Cons: Limited to six individual users. Choosing the right antivirus involves balancing pricing with security needs, with larger companies possibly requiring comprehensive solutions and smaller businesses finding adequate protection in budget-friendly options. The products were selected based on unique business-focused features and positive customer feedback.
Winsage
August 14, 2024
Microsoft resolved an issue affecting Microsoft 365 Defender (Defender XDR) that arose after the July 2024 Windows Server updates, specifically impacting Windows Server 2022 and disrupting the Network Detection and Response (NDR) service. This disruption also affected other Defender functionalities reliant on NDR, such as Incident Response and Device Inventory. The issue was addressed by Windows updates released on August 13, 2024 (KB5041160) and later. Users are advised to install the latest updates for crucial improvements. Additionally, Microsoft fixed another issue causing LPD printing jobs to fail across Windows Server 2022, 2019, and 2016 systems after the July 2024 updates. An emergency fix was also deployed in May for Windows Server 2019 to resolve 0x800f0982 errors. Earlier in May, Microsoft addressed issues disrupting VPN connections, unexpected reboots of domain controllers, and NTLM authentication failures after April's updates. However, a lingering bug affecting remote desktop connections on Windows Server 2012 and later continues to cause intermittent logon session losses, requiring reconnections.
Search