ExtraHop’s Post

Transcript

Hey, my name is Paul Giorgi. I'm the VP of Global Sales Engineering here at ExtraHop. And the next couple of minutes I'm just going to run through a presentation that I named "Ransomware as Noisy, Learn to Listen." And the reason why I named it that is we've got a lot of indicators that there's a ransomware event happening. However, most organizations kind of just focus on a couple. And I'm going to show you how NDR and having the visibility that the network provides gives you so much more to understand and interpret and hopefully detect things faster. So in this. Slide right here. You can see that we've got kind of the the main categories of what what's happening during a ransomware campaign. We called it campaign because there is so many events that are happening. So we got the initial intrusion. We understand that in most organizations there's not a lot that you can do to really prevent that. I always use the analogy of if if someone really wanted to break into my house, given enough motivation and the right equipment and the right funding, I don't care who you are, you're going to get my house whether you're breaking a window. Blowing down a door or something. We, we kind of have that same mentality when it comes to initial intrusion between phishing attacks being as prevalent and as successful. They are using a new vulnerability that maybe you just got released. It's really one day or a zero day. And then you got things like initial access brokers that I be right there. So we've got dark web credentials where people are actually saying, hey, you want to go to this organization, give me a few $100 in crypto and I will give you good. Credentials for you to log into a VPN. So we have to understand that people will get in threat actors will get into our environment. We need to be able to catch them when they do. And we need to understand kind of what all the steps that they do to kind of block them early on. Because if you look at that last stage extortion, we don't want to just block the extortion. If we know that there are going to be or threat actors are they're able to get that initial intrusion. We don't want to just say, hey, I'm seeing things being encrypted or I'm seeing. That data will use leave my organization. If you're setting up your defenses to not look at anything besides initial intrusion or the extortion, probably don't write have the defense strategy because you want to be able to detect it sooner. You need to be able to detect out during that post compromise. Unluckily, like the presentation is named, there is a lot of events. It's very noisy, whether it's the data staging, the establishing command and control, the enumerating the different targets, the escalating your privileges, the lateral movement, there's there's so many. Different events that are happening after that initial access or the initial intrusion happens that if you have the ability to detect it, you will be able to see it much sooner and hopefully block it, cut off that access from those threat actors before you get to the things like the extortion or the data exfiltration. So in the past and if you look at like a lot of different solutions that are out there, there are solutions to prevent specific things like lateral movement or data staging to name domain enumeration. The power of the network is with one network cable, so one data feed. I have the ability to see all of those events within post compromise. We've got a bunch of different kind of like slides tracking all of the different mappings that we have as a solution from our platform to be able to map to all the different mitre techniques and tactics. And you'd be amazed, there's something like 90% of the coverage that we can get from a a miter alignment within a ransomware attack. So there's a lot that we can see if you just feed us the network. So really. Powerful stuff. So now let's overlay kind of what what extra Hop does with our Reveal X solution across these big categories. So you've got your initial intrusion, I just said a minute ago, like we, we have to assume that there will be a few that get through. But there is a lot of value in trying to prevent it. Understand when you see things like, hey, I'm seeing somebody trying to utilize this new vulnerability or I'm seeing this anomalous behavior from this login or the SQL injection attack, kind of those things that you traditionally see within your signature. IDs. So we've got that within our next generation IDs module. Now if you look at for a post compromise, this is where we're going to see all of those things. We're gonna see the lateral movement, we're going to see all the domain escalation. We're going to see the establishing the command and control, because we have all of that in network visibility. You see underneath where you can see all the different capabilities from just understanding what's happening within your network. So then finally, you've got the ability to look at what's happening from like an actual extortion. Perspective, well, I hope that most organizations will catch it before it actually gets to that point. If you do end up in a situation where you're having to deal with, hey, we've got files that are being encrypted now I have a running record of every single network transaction that that leverage that network or those files. So I can understand what's happening and I understand kind of how to respond or recover correctly because I understand the full scope of what's happening from that network visibility. We also have the ability to do packet capture so if you want to. See what was actually leaving your organization. A lot of times we have the ability to to look at that that that tunnel or that HTTP stream or whatever it is that protocol that's leaving that traffic. So you see it going out, you now have it recorded so you can do a little bit of forensics and see what was it that was actually lost. So you have a full understanding of how to respond. This slide right here kind of takes that blast slide and puts it a little bit of stuff further. Yes, we still have got that initial intrusion, but in that middle where it says. Most compromise it gives you kind of a a small little screenshot from our platform this is what we call our detection timeline. When we detect something we will create a big detection and one of the sections within it we will outline come all of the related detections and put it on a timeline. So you can see hey we understand that we detected this but we see all these other related detections whether it was hey this is when they first got their initial access, we saw suspicious SMB or SIPS client file reads, we see data staging, then we see data exfiltration so. From that single detection, we tie all of the related events together and then allow you to understand kind of what the whole campaign consisted of. It isn't just a series of disconnected events or disconnected detections. We tie it all together to give you a full capability of the timeline that happened throughout that whole attack. So now you have the ability to hopefully attack or stop the attack. So that's what that little box there is showing that if you do have an A threat actor that makes that initial intrusion so they've got. Access, hopefully with the power of the network and the power of a reveal acts, you have the ability to understand what's happening. So maybe you'll have a little bit of unusual interactive traffic from an external endpoint. Maybe you'll have a few file reads. But hopefully you will catch it because of our platform and our alerting and that visibility would give you. So that way you have the ability to cut it off quicker and not allow it to get to the point where it's actually encrypting or exfiltrating data they used for extortion. So that was a quick run through of the platform. And and kind of the capabilities how it aligns to ransomware, I always like using the statistics of why our customers using US for POC's. And I was actually just looking at the last few quarters and by far the most amount of kind of the the solution alignment to customers needs has been related to ransomware. So it's not necessarily us forcing saying like hey, we're ransomware solution, but organizations are realizing that we do have the ability to really enhance their ransomware capabilities and so. If you look at how our organizations are using S and the capabilities of our platform, you'll see that it gives us a lot of visibility to hopefully take that that protection and that visibility against ransomware attacks in the next level. So thank you. Bye.