SOC Walkthrough: The Anatomy of a VPN Compromise | Huntress скачать в хорошем качестве

SOC Walkthrough: The Anatomy of a VPN Compromise | Huntress

Ever wonder what goes on behind the scenes within telemetry during a VPN compromise? Let's peel back the layers and find out! Here's what went down at a manufacturing company: This organization had Huntress SIEM in place, and an alert triggered as soon as the threat actor authenticated within their network using a known malicious workstation name At this point, the host was isolated to prevent further lateral movement and follow-on activity. Upon a review of the VPN logs, the source of this intrusion was uncovered: a forgotten "Guest" account enabled on the VPN appliance Here's the cool part - further analysis of the malicious IP address revealed that this threat actor was exposing RDP and leaking their hostname - this hostname matched up exactly with the Windows authentication events within the victim network! Threat actors are always looking for weak spots in your network, don't give them an inch! Ensure all unused accounts are disabled on your VPN appliances. Always enable MFA for all your VPN accounts, yes even VIPs This case is also illustrative of how Huntress SIEM and EDR work together to protect your environments. SIEM takes care of critical Windows events; in this case, it allowed us to isolate the network before the threat actor even had a chance to execute a command within the environment. Had they done so, EDR would have kicked in. A layered approach to your cyber defenses is critical, and this case is illustrative of that. Protect Your Endpoints, Identities, Logs, and Employees. The fully managed security platform that combines endpoint detection and response, Microsoft 365 identity protection, a predictably affordable SIEM and science-based security awareness training. Powered by custom-built enterprise technology for mid-market enterprises, small businesses, and the MSPs that support them and delivered by unrivaled industry analysts in our 24/7 Security Operations Center.