AlphaSOC

Want to flag anomalies within your AWS environment and overlay them with MITRE ATT&CK? We have extended our analytics engine to process CloudTrail logs and highlight 70+ threats. Here's a full list of detection use cases >> https://lnkd.in/e_RShSBn

Want to check whether your threat detection stack can flag C2 beacons, anonymizing circuit traffic, cryptomining, DNS tunneling, and other threats? Use our free, open source adversary simulation tool to instantly evaluate your coverage >> https://buff.ly/3DVIYgn

The AlphaSOC engine uses 60+ individual flags to alert defenders of both known and unknown emerging threats (e.g. beaconing to a young domain impersonating a known brand) and solve the "patient zero" problem at scale. Here's the full list of flags >> https://lnkd.in/eZW7gUQF

Process your #AWS VPC flow and Route 53 query resolver logs using our AMI to highlight anomalies and uncover compromised hosts within your environment. Deploy our Analytics Engine in minutes via the AWS Marketplace >> https://t.co/lANKDvXcMh

We track the most dangerous effective top-level domains (eTLDs) online by processing the indicators within our platform each month. Our feed is updated daily, and you can use it to instantly block traffic to statistically bad domains >> https://lnkd.in/ekyZVb8i

We proactively track Storm-1575 phishing-as-a-service infrastructure to protect our customers, including this domain with very low coverage on VirusTotal >> https://buff.ly/3S1WJ37

Native cloud detection tools such as GuardDuty and Defender for Cloud are blind to many data exfiltration and C2 traffic patterns. Detection and response teams use the AlphaSOC analytics stack to solve 70+ use cases and bolster coverage. Learn more >> https://t.co/YA9YhxHwOT

An attack chain using stolen signing certificates and fake CAPTCHAs is being used to distribute Lumma Stealer, as reported this week by Harfanglab. The AlphaSOC Analytics Engine flags these C2 patterns to protect customers. Read the latest research here >>

We process network telemetry to cover 70+ out-of-the-box detection use cases and highlight patterns including spear phishing, impersonation attacks, anonymizing circuit traffic (e.g. Tor and I2P) and cryptomining pool participation. Read more >> https://buff.ly/3xOM0Q5

Got Splunk? Our native integration processes your telemetry (DNS, IP, HTTP, TLS events) to uncover both known and unknown emerging threats. Network Behavior Analytics for Splunk is free to download and install in minutes from Splunkbase >> https://lnkd.in/gbucb2ph