active adversary – Computer Security Articles

The Bite from Inside: The Sophos Active Adversary Report

December 12, 2024 admin active adversary, active adversary report, Featured, Incident Response, ir, lolbins, mdr, RDP, security operations, threat research

Credit to Author: Angela Gunn| Date: Thu, 12 Dec 2024 14:00:56 +0000

A sea change in available data fuels fresh insights from the first half of 2024

Security Sophos

RD Web Access abuse: Fighting back

June 13, 2024 admin active adversary, active adversary report, Featured, Incident Response, RDP, security operations, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Wed, 12 Jun 2024 18:59:54 +0000

Investigation insights and recommendations from a recent welter of incident-response cases

Security Sophos

It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024

April 15, 2024 admin active adversary, active adversary report, Case study, Featured, Incident Response, RDP, threat research

Credit to Author: Angela Gunn| Date: Wed, 03 Apr 2024 10:01:37 +0000

The latter half of 2023 found numerous fronts on which attackers failed to press ahead. Are defenders failing to take advantage?

Security Sophos

Remote Desktop Protocol: The Series

March 20, 2024 admin active adversary, Featured, Incident Response, incident response tools, mdr, RDP, security operations, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:18:21 +0000

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Security Sophos

‘AuKill’ EDR killer malware abuses Process Explorer driver

April 19, 2023 admin active adversary, active adversary playbook, anti-edr, aukill, backstab, EDR, edr killer, Featured, malware, process explorer, procexp, sophos x-ops, Targeted Attacks, threat research

Credit to Author: Andrew Brandt| Date: Wed, 19 Apr 2023 10:00:43 +0000

Driver based attacks against security products are on the rise

Security Sophos

Defenders vs. Adversaries: The Two-Speed Cybersecurity 2023 Race

April 4, 2023 admin active adversary, EDR, Endpoint, Featured, mdr, Network, products & services, security operations, XDR

Credit to Author: Sally Adam| Date: Tue, 04 Apr 2023 09:45:12 +0000

Slowed by multiple headwinds, defenders are falling behind while adversaries continue to accelerate. Organizations need to speed up the defender flywheel to enable them to pull ahead.

Security Sophos

Cookie stealing: the new perimeter bypass

August 18, 2022 admin active adversary, cookie theft, Featured, information stealers, infostealer malware, sophos x-ops, threat research

Credit to Author: gallagherseanm| Date: Thu, 18 Aug 2022 11:00:50 +0000

As organizations move to cloud services and multifactor authentication, cookies tied to identity and authentication give attackers a new path to compromise.

Security Sophos

The Active Adversary Playbook 2022

June 7, 2022 admin active adversary, artifacts, attack tools, cobalt strike, cryptomining, cyberattacks, cyberthreats, dwell time, exploit, Featured, initial access broker, malware delivery system, MITRE, proxylogon, proxyshell, ransomware, Ransomware as a Service, security operations, sophos rapid response, Vulnerability

Credit to Author: Tilly Travers| Date: Tue, 07 Jun 2022 11:02:43 +0000

Cyberattacker behaviors, tactics and tools seen on the frontline of incident response during 2021

← Previous