Alex Lanstein’s Post

A nice summary of the "Password Spray" method: "Unlike brute force attacks that target a single account using many passwords, password spray attacks help adversaries maximize their chances for success and minimize the likelihood of automatic account lockouts." And... PLEASE turn on MFA. Don't make me come over there.

Our Digital Forensics and Incident Response (#DFIR) team has observed a troubling trend: threat actors exploiting Microsoft 365's third-party application consent settings. In our latest blog, ZeroFox VP of Response, Jamie Tolles, details how attackers use legitimate apps like PerfectData Software to facilitate data exfiltration and maintain persistence beyond password resets. Read Jamie's full analysis, including a case study and #response recommendations: https://ow.ly/EcvP50SWeeY

Mechanics Blog: Detect and prevent data security incidents. Watch this true crime case, and see how Microsoft Purview is designed to help. Read and Follow our Blog here: https://lnkd.in/gkjyP4tT BLOG SYNOPSIS: Detect and prevent data security incidents with Microsoft Purview. Combine data classification with proactive and adaptive data loss prevention policies aligned to the assessed insider risk level for a multi-layered approach. #MicrosoftPurview #DLP #InsiderRisk #InformationProtection #PurviewCase

According to CrowdStrike's 2024 Global Threat Report, the total number of advertisements from access brokers increased almost 20% in 2023. In addition, IBM reports a 71% increase in the number of attacks relying on login credentials. We all know cyberattacks are on the rise. DarkOwl's DarkSonar is a relative risk rating that considers the nature, extent and severity of credential leakage on the darknet to provide a company with a signal that acts as a measurement for a company’s exposure. In an analysis of over 250 companies that suffered from cyberattacks, their DarkSonar signal was elevated nearly 75% of the time months prior to the attack. This indicates that DarkSonar can help organizations assess their risk level as an additive data point – and potentially predict a pending threat. Learn more today > https://hubs.li/Q02p4Kqg0

Risk detection, are your systems secure? As the digital transformation race continues for both Governmental and private institutions, we are seeing a shift to digital which is a welcomed step as through digital transformation, we are able to gain more insight, streamline processes and enable informed decision making through a data driven approach. This provides significant value addition to an organization’s data flow and increases both operational efficiency and management. Securing these systems therefore should be a priority so as to protect organization’s data(personnel and operational) which can be achieved through the introduction of threat detection systems that monitor: 1. Abrupt increase in requests to resources. 2. Brute force login attacks that attempt many passwords with hopes of finding one that eventually works. 3. DDoS attempts and manage them through load balancers if legit or drop connections detected to come from nefarious IP addresses (can be matched against known IP addresses on a blacklist). #threatdetection #digitaltransformation #digitalbusinesstransformation

Silobreaker integrates with DarkOwl for enhanced darknet credential monitoring: Silobreaker has integrated with DarkOwl for credential monitoring. The DarkOwl Credential Monitoring solution continuously checks for exposed credentials in darknet and darknet-adjacent sites, providing Silobreaker customers with detailed alerting and analytics within a single platform. Credential exposure can lead to significant reputational damage and financial losses, meaning that swift detection and response is crucial to minimising the risks of credential misuse. Silobreaker’s credential monitoring product focuses on customers’ email domains, and checks deep and dark … More → The post Silobreaker integrates with DarkOwl for enhanced darknet credential monitoring appeared first on Help Net Security.

Let's Try It! Pretend you have a data breach - what happens? 🧨🧪 //After finding the contingency plans from 3 years ago, (on the old house, you know) you worry if they are even updated given the names on the cover. There is no evidence of this ever being practically performed, so you wonder if you will have confidence this time (again). // 😢 The challenge is in imagining how to try it, and how to repeat it. Trying things is a testing problem! We can rehearse, have desktop exercises, and run small experiments. We can document the findings. We can even set up controls recurringly. 💡 There is more to testing than checking functional requirements. Just ask 😉 #NNITcyber #TestManagement #ComplianceTesting

✅ Investigating #lateral_movement #attacks involve understanding how an attacker moves through a network after gaining initial access. Here are steps to investigate such attacks: 1️⃣ #Identify_Anomalies: Monitor network traffic, system logs, and user activity to identify unusual or suspicious behavior. 2️⃣ #Map_Network_Topology: Understand the organization's network structure to identify potential pathways attackers may exploit. 3️⃣ #Analyze_Log_Data: Examine logs for signs of lateral movement, such as unusual account access, privilege escalation, or abnormal service activity. 4️⃣ #Endpoint_Analysis: Investigate compromised endpoints for evidence of lateral movement, including unauthorized access and new user accounts. 5️⃣ #Review_Access_Controls: Check user permissions and access controls to identify any deviations from the norm. 6️⃣ #Behavioral_Analysis: Use behavioral analytics tools to detect abnormal patterns in user behavior or system activity. 7️⃣ #Correlate_Events: Correlate events across different systems to identify the progression of the lateral movement. 8️⃣ #Intrusion_Detection_Systems (IDS): Review IDS alerts for indications of lateral movement, like suspicious connections between internal systems. 9️⃣ #User_Account_Analysis: Scrutinize user accounts for signs of compromise, such as unusual login times or multiple failed login attempts. 10. #Incident_Response: Follow the incident response plan to contain and mitigate the lateral movement, isolating affected systems and preventing further spread. 11. #Forensic_Analysis: Conduct forensic analysis on affected systems to gather evidence and understand the extent of the lateral movement. 12. #Patch_and_Remediate: Once the investigation is complete, apply patches, update security configurations, and implement measures to prevent future lateral movement.

Scammers often try to scare their targets by taking advantage of something urgent. We see this even more during a crisis, such as the recent CrowdStrike outage. Attackers are pushing fake CrowdStrike fixes that infect your computer. When reading emails or text messages during these events, stay calm and ensure that the message comes from the trusted source. If in doubt, reach out using a different contact method. For example, if you got an email, make a phone call. Remember to NEVER CLICK LINKS in suspicious messages. Tech Tip Tuesday: Here at LinkTech, we deploy an assortment of trusted tools and defenses, as well as help keep your team aware of the threats that are happening. Call us at 605-644-7360 to learn more about how we can help protect your business.

It is important to note that not all exploited systems may show the same indicators, and, indeed, a skilled attacker may be able to remove traces of their work. It is not possible to prove a device has not been compromised; when there is any uncertainty, you should consider the device compromised.