Blog

Keine Artikel gefunden.

Entry via Sentry: Analyzing the Exploitation of a Critical Vulnerability in Ivanti Sentry

Standard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-Blogbild
20
Dec 2023
20
Dec 2023
In late August 2023, Darktrace observed malicious actors exploiting vulnerabilities on Ivanti Sentry servers within customer networks. Following these successful exploits, a variety of cryptomining and reconnaissance tools were delivered. In this blog, we will provide details of these chains of activity, along with details of Darktrace/Network’s coverage of the steps involved in them.

In an increasingly interconnected digital landscape, the prevalence of critical vulnerabilities in internet-facing systems stands as an open invitation to malicious actors. These vulnerabilities serve as a near limitless resource, granting attackers a continually array of entry points into targeted networks.

In the final week of August 2023, Darktrace observed malicious actors validating exploits for one such critical vulnerability, likely the critical RCE vulnerability, CVE-2023-38035, on Ivanti Sentry servers within multiple customer networks. Shortly after these successful tests were carried out, malicious actors were seen delivering crypto-mining and reconnaissance tools onto vulnerable Ivanti Sentry servers.

Fortunately, Darktrace DETECT™ was able to identify this post-exploitation activity on the compromised servers at the earliest possible stage, allowing the customer security teams to take action against affected devices. In environments where Darktrace RESPOND™ was enabled in autonomous response mode, Darktrace was further able inhibit the identified post-exploitation activity and stop malicious actors from progressing towards their end goals.

Exploitation of Vulnerabilities in Ivanti Products

The software provider, Ivanti, offers a variety of widely used endpoint management, service management, and security solutions. In July and August 2023, the Norwegian cybersecurity company, Mnemonic, disclosed three vulnerabilities in Ivanti products [1]/[2]/[3]; two in Ivanti's endpoint management solution, Ivanti Endpoint Manager Mobile (EPMM) (formerly called 'MobileIron Core'), and one in Ivanti’s security gateway solution, Ivanti Sentry (formerly called 'MobileIron Sentry'):

CVE-2023-35078

  • CVSS Score: 10.0
  • Affected Product: Ivanti EPMM
  • Details from Ivanti: [4]/[5]/[6]
  • Vulnerability type: Authentication bypass

CVE-2023-35081

  • CVSS Score: 7.2
  • Affected Product: Ivanti EPMM
  • Details from Ivanti: [7]/[8]/[9]
  • Vulnerability type: Directory traversal

CVE-2023-38035

  • CVSS Score:
  • Affected Product: Ivanti Sentry
  • Details from Ivanti: [10]/[11]/[12]
  • Vulnerability type: Authentication bypass

At the beginning of August 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) provided details of advanced persistent threat (APT) activity targeting EPMM systems within Norwegian private sector and government networks via exploitation of CVE-2023-35078 combined with suspected exploitation of CVE-2023-35081.

In an article published in August 2023 [12], Ivanti disclosed that a very limited number of their customers had been subjected to exploitation of the Ivanti Sentry vulnerability, CVE-2023-38035, and on the August 22, 2023, CISA added the Ivanti Sentry vulnerability, CVE-2023-38035 to its ‘Known Exploited Vulnerabilities Catalogue’.  CVE-2023-38035 is a critical authentication bypass vulnerability affecting the System Manager Portal of Ivanti Sentry systems. The System Manager Portal, which is accessible by default on port 8433, is used for administration of the Ivanti Sentry system. Through exploitation of CVE-2023-38035, an unauthenticated actor with access to the System Manager Portal can achieve Remote Code Execution (RCE) on the underlying Ivanti Sentry system.

Observed Exploitation of CVE-2023-38035

On August 24, Darktrace observed Ivanti Sentry servers within several customer networks receiving successful SSL connections over port 8433 from the external endpoint, 34.77.65[.]112. The usage of port 8433 indicates that the System Manager Portal was accessed over the connections. Immediately after receiving these successful connections, Ivanti Sentry servers made GET requests over port 4444 to 34.77.65[.]112. The unusual string ‘Wget/1.14 (linux-gnu)’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, wget, was abused to initiate the requests.

Figure 1: Event Log data for an Ivanti Sentry system showing the device breaching a range of DETECT models after contacting 34.77.65[.]112.The suspicious behavior highlighted by DETECT was subsequently investigated by Darktrace’s Cyber AI Analyst™, which was able to weave together these separate behaviors into single incidents representing the whole attack chain.

Figure 2: AI Analyst Incident representing a chain of suspicious activities from an Ivanti Sentry server.

In cases where Darktrace RESPOND was enabled in autonomous response mode, RESPOND was able to automatically enforce the Ivanti Sentry server’s normal pattern of life, thus blocking further exploit testing.

Figure 3: Event Log for an Ivanti Sentry server showing the device receiving a RESPOND action immediately after trying to 34.77.65[.]112.

The GET requests to 34.77.65[.]112 were responded to with the following HTML document:

Figure 4: Snapshot of the HTML document returned by 34.77.65[.]112.

None of the links within this HTML document were functional. Furthermore, the devices’ downloads of these HTML documents do not appear to have elicited further malicious activities. These facts suggest that the observed 34.77.65[.]112 activities were representative of a malicious actor validating exploits (likely for CVE-2023-38035) on Ivanti Sentry systems.

Over the next 24 hours, these Ivanti Sentry systems received successful SSL connections over port 8433 from a variety of suspicious external endpoints, such as 122.161.66[.]161. These connections resulted in Ivanti Sentry systems making HTTP GET requests to subdomains of ‘oast[.]site’ and ‘oast[.]live’. Strings containing ‘curl’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, cURL, was abused to initiate the requests.

These ‘oast[.]site’ and ‘oast[.]live’ domains are used by the out-of-band application security testing (OAST) service, Interactsh. Malicious actors are known to abuse this service to carry out out-of-band (OOB) exploit testing. It, therefore, seems likely that these activities were also representative of a malicious actor validating exploits for CVE-2023-38035 on Ivanti Sentry systems.

Figure 5: Event Log for Ivanti Sentry system showing the device contacting an 'oast[.]site' endpoint after receiving connections from the suspicious, external endpoint 122.161.66[.]161.

The actors seen validating exploits for CVE-2023-38035 may have been conducting such activities in preparation for their own subsequent malicious activities. However, given the variety of attack chains which ensued from these exploit validation activities, it is also possible that they were carried out by Initial Access Brokers (IABs) The activities which ensued from exploit validation activities identified by Darktrace fell into two categories: internal network reconnaissance and cryptocurrency mining.

Reconnaissance Activities

In one of the reconnaissance cases, immediately after receiving successful SSL connections over port 8443 from the external endpoints 190.2.131[.]204 and 45.159.248[.]179, an Ivanti Sentry system was seen making a long SSL connection over port 443 to 23.92.29[.]148, and making wget GET requests over port 4444 with the Target URIs '/ncat' and ‘/TxPortMap’ to the external endpoints, 45.86.162[.]147 and 195.123.240[.]183.  

Figure 6: Event Log data for an Ivanti Sentry system showing the device making connections to the external endpoints, 45.86.162[.]147, 23.92.29[.]148, and 195.123.240[.]183, immediately after receiving connections from rare external endpoints.

The Ivanti Sentry system then went on to scan for open SMB ports on systems within the internal network. This activity likely resulted from an attacker dropping a port scanning utility on the vulnerable Ivanti Sentry system.

Figure 7: Event Log data for an Ivanti Sentry server showing the device breaching several DETECT models after downloading a port scanning tool from 195.123.240[.]183.

In another reconnaissance case, Darktrace observed multiple wget HTTP requests with Target URIs such as ‘/awp.tar.gz’ and ‘/resp.tar.gz’ to a suspicious, external server (78.128.113[.]130).  Shortly after making these requests, the Ivanti Sentry system started to scan for open SMB ports and to respond to LLMNR queries from other internal devices. These behaviors indicate that the server may have installed an LLMNR poisoning tool, such as Responder. The Ivanti Sentry server also went on to conduct further information-gathering activities, such as LDAP reconnaissance, HTTP-based vulnerability scanning, HTTP-based password searching, and RDP port scanning.

Figure 8: Event Log data for an Ivanti Sentry system showing the device making connections to 78.128.113[.]130, scanning for an open SMB port on internal endpoints, and responding to LLMNR queries from internal endpoints.

In cases where Darktrace RESPOND was active, reconnaissance activities resulted in RESPOND enforcing the Ivanti Sentry server’s pattern of life.

Figure 9: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its SMB port scanning activity.
Figure 10: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its LDAP reconnaissance activity.

Crypto-Mining Activities

In one of the cryptomining cases, Darktrace detected an Ivanti Sentry server making SSL connections to aelix[.]xyz and mining pool endpoints after receiving successful SSL connections over port 8443 from the external endpoint, 140.228.24[.]160.

Figure 11: Event Log data for an Ivanti Sentry system showing the device contacting aelix[.]xyz and mining pool endpoints immediately after receiving connections from the external endpoint, 140.228.24[.]160.

In a cryptomining case on another customer’s network, an Ivanti Sentry server was seen making GET requests indicative of Kinsing malware infection. These requests included wget GET requests to 185.122.204[.]197 with the Target URIs ‘/unk.sh’ and ‘/se.sh’ and a combination of GET and POST requests to 185.221.154[.]208 with the User-Agent header ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36’ and the Target URIs, ‘/mg’, ‘/ki’, ‘/get’, ‘/h2’, ‘/ms’, and ‘/mu’. These network-based artefacts have been observed in previous Kinsing infections [13].

Figure 12: Event Log data for an Ivanti Sentry system showing the device displaying likely Kinsing C2 activity.

On customer environments where RESPOND was active, Darktrace was able to take swift autonomous action by blocking cryptomining connection attempts to malicious command-and-control (C2) infrastructure, in this case Kinsing servers.

Figure 13: Event Log data for an Ivanti Sentry server showing the device receiving a RESPOND action after attempting to contact Kinsing C2 infrastructure.

Fortunately, due to Darktrace DETECT+RESPOND prompt identification and targeted actions against these emerging threats, coupled with remediating steps taken by affected customers’ security teams, neither the cryptocurrency mining activities nor the network reconnaissance activities led to significant disruption.  

Figure 14: Timeline of observed malicious activities.

Conclusion The inevitable presence of critical vulnerabilities in internet-facing systems underscores the perpetual challenge of defending against malicious intrusions. The near inexhaustible supply of entry routes into organizations’ networks available to malicious actors necessitates a more proactive and vigilant approach to network security.

While it is, of course, essential for organizations to secure their digital environments through the regular patching of software and keeping abreast of developing vulnerabilities that could impact their network, it is equally important to have a safeguard in place to mitigate against attackers who do manage to exploit newly discovered vulnerabilities.

In the case of Ivanti Sentry, Darktrace observed malicious actors validating exploits against affected servers on customer networks just a few days after the public disclosure of the critical vulnerability.  This activity was followed up by a variety of malicious and disruptive, activities including cryptocurrency mining and internal network reconnaissance.

Darktrace DETECT immediately detected post-exploitation activities on compromised Ivanti Sentry servers, enabling security teams to intervene at the earliest possible stage. Darktrace RESPOND, when active, autonomously inhibited detected post-exploitation activities. These DETECT detections, along with their accompanying RESPOND interventions, prevented malicious actors from being able to progress further towards their likely harmful objectives.

Credit to Sam Lister, Senior Cyber Analyst, and Trent Kessler, SOC Analyst  

Appendices

MITRE ATT&CK Mapping

Initial Access techniques:

  • Exploit Public-Facing Application (T1190)

Credential Access techniques:

  • Unsecured Credentials: Credentials In Files (T1552.001)
  • Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)

Entdeckung

  • Network Service Discovery (T1046)
  • Remote System Discovery (T1018)
  • Account Discovery: Domain Account (T1087.002)

Command and Control techniques:

  • Application Layer Protocol: Web Protocols (T1071.001)
  • Ingress Tool Transfer (T1105)
  • Non-Standard Port (T1571)
  • Encrypted Channel: Asymmetric Cryptography (T1573.002)

Impact techniques

  • Resource Hijacking (T1496)
List of IoCs

Exploit testing IoCs:

·      34.77.65[.]112

·      Wget/1.14 (linux-gnu)

·      cjjovo7mhpt7geo8aqlgxp7ypod6dqaiz.oast[.]site • 178.128.16[.]97

·      curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

·      cjk45q1chpqflh938kughtrfzgwiofns3.oast[.]site • 178.128.16[.]97

·      curl/7.29.0

Kinsing-related IoCs:

·      185.122.204[.]197

·      /unk.sh

·      /se.sh

·      185.221.154[.]208

·      185.221.154[.]208

·      45.15.158[.]124

·      Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

·      /mg

·      /ki

·      /get

·      /h2

·      /ms

·      /mu

·      vocaltube[.]ru • 185.154.53[.]140

·      92.255.110[.]4

·      194.87.254[.]160

Responder-related IoCs:

·      78.128.113[.]130

·      78.128.113[.]34

·      /awp.tar.gz

·      /ivanty

·      /resp.tar.gz

Crypto-miner related IoCs:

·      140.228.24[.]160

·      aelix[.]xyz • 104.21.60[.]147 / 172.67.197[.]200

·      c8446f59cca2149cb5f56ced4b448c8d (JA3 client fingerprint)

·      b5eefe582e146aed29a21747a572e11c (JA3 client fingerprint)

·      pool.supportxmr[.]com

·      xmr.2miners[.]com

·      xmr.2miners[.]com

·      monerooceans[.]stream

·      xmr-eu2.nanopool[.]org

Port scanner-related IoCs:

·      122.161.66[.]161

·      192.241.235[.]32

·      45.86.162[.]147

·      /ncat

·      Wget/1.14 (linux-gnu)

·      45.159.248[.]179

·      142.93.115[.]146

·      23.92.29[.]148

·      /TxPortMap

·      195.123.240.183

·      6935a8d379e086ea1aed159b8abcb0bc8acf220bd1cbc0a84fd806f14014bca7 (SHA256 hash of downloaded file)

Darktrace DETECT Model Breaches

·      Anomalous Server Activity / New User Agent from Internet Facing System

·      Device / New User Agent

·      Anomalous Connection / New User Agent to IP Without Hostname

·      Device / New User Agent and New IP

·      Anomalous Connection / Application Protocol on Uncommon Port

·      Anomalous Connection / Callback on Web Facing Device

·      Compromise / High Volume of Connections with Beacon Score

·      Compromise / Large Number of Suspicious Failed Connections

·      Compromise / High Volume of Connections with Beacon Score

·      Compromise / Beacon for 4 Days

·      Compromise / Agent Beacon (Short Period)

·      Device / Large Number of Model Breaches

·      Anomalous Server Activity / Rare External from Server

·      Compromise / Large Number of Suspicious Successful Connections

·      Compromise / Monero Mining

·      Compromise / High Priority Crypto Currency Mining

·      Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

·      Device / Internet Facing Device with High Priority Alert

·      Device / Suspicious SMB Scanning Activity

·      Device / Internet Facing Device with High Priority Alert

·      Device / Network Scan

·      Device / Unusual LDAP Bind and Search Activity

·      Compliance / Vulnerable Name Resolution

·      Device / Anomalous SMB Followed By Multiple Model Breaches

·      Device / New User Agent To Internal Server

·      Anomalous Connection / Suspicious HTTP Activity

·      Anomalous Connection / Unusual Internal Connections

·      Anomalous Connection / Suspicious HTTP Activity

·      Device / RDP Scan

·      Device / Large Number of Model Breaches

·      Compromise / Beaconing Activity To External Rare

·      Compromise / Beacon to Young Endpoint

·      Anomalous Connection / Suspicious HTTP Activity

·      Compromise / Suspicious Internal Use Of Web Protocol

·      Anomalous File / EXE from Rare External Location

·      Anomalous File / Internet Facing System File Download

·      Device / Suspicious SMB Scanning Activity

·      Device / Internet Facing Device with High Priority Alert

·      Device / Network Scan

·      Device / Initial Breach Chain Compromise

References

[1] https://www.mnemonic.io/resources/blog/ivanti-endpoint-manager-mobile-epmm-authentication-bypass-vulnerability/
[2] https://www.mnemonic.io/resources/blog/threat-advisory-remote-file-write-vulnerability-in-ivanti-epmm/
[3] https://www.mnemonic.io/resources/blog/threat-advisory-remote-code-execution-vulnerability-in-ivanti-sentry/
[4] https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
[5] https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
[6] https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078?language=en_US
[7] https://www.ivanti.com/blog/cve-2023-35081-new-ivanti-epmm-vulnerability
[8] https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US
[9] https://forums.ivanti.com/s/article/KB-Arbitrary-File-Write-CVE-2023-35081?language=en_US
[10] https://www.ivanti.com/blog/cve-2023-38035-vulnerability-affecting-ivanti-sentry
[11] https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
[12] https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
[13] https://isc.sans.edu/diary/Your+Business+Data+and+Machine+Learning+at+Risk+Attacks+Against+Apache+NiFi/29900

EINBLICKE IN DAS SOC-Team
Darktrace Cyber-Analysten sind erstklassige Experten für Threat Intelligence, Threat Hunting und Incident Response. Sie bieten Tausenden von Darktrace Kunden auf der ganzen Welt rund um die Uhr SOC-Support. Einblicke in das SOC-Team wird ausschließlich von diesen Experten verfasst und bietet Analysen von Cyber-Vorfällen und Bedrohungstrends, die auf praktischen Erfahrungen in diesem Bereich basieren.
AUTOR
ÜBER DEN AUTOR
Sam Lister
SOC Analyst
Book a 1-1 meeting with one of our experts
share this article
ANWENDUNGSFÄLLE
Keine Artikel gefunden.
PRODUKT-SPOTLIGHT
Keine Artikel gefunden.
COre-Abdeckung
Keine Artikel gefunden.

More in this series

Keine Artikel gefunden.

Blog

E-Mail

Looking Beyond Secure Email Gateways with the Latest Innovations to Darktrace/Email

Standard-BlogbildStandard-Blogbild
09
Apr 2024

Organizations Should Demand More from their Email Security

In response to a more intricate threat landscape, organizations should view email security as a critical component of their defense-in-depth strategy, rather than defending the inbox alone with a traditional Secure Email Gateway (SEG). Organizations need more than a traditional gateway – that doubles, instead of replaces, the capabilities provided by native security vendor – and require an equally granular degree of analysis across all messaging, including inbound, outbound, and lateral mail, plus Teams messages.  

Darktrace/Email is the industry’s most advanced cloud email security, powered by Self-Learning AI. It combines AI techniques to exceed the accuracy and efficiency of leading security solutions, and is the only security built to elevate, not duplicate, native email security.  

With its largest update ever, Darktrace/Email introduces the following innovations, finally allowing security teams to look beyond secure email gateways with autonomous AI:

  • AI-augmented data loss prevention to stop the entire spectrum of outbound mail threats
  • an easy way to deploy DMARC quickly with AI
  • major enhancements to streamline SOC workflows and increase the detection of sophisticated phishing links
  • expansion of Darktrace’s leading AI prevention to lateral mail, account compromise and Microsoft Teams

What’s New with Darktrace/Email  

Data Loss Prevention  

Block the entire spectrum of outbound mail threats with advanced data loss prevention that builds on tags in native email to stop unknown, accidental, and malicious data loss

Darktrace understands normal at individual user, group and organization level with a proven AI that detects abnormal user behavior and dynamic content changes. Using this understanding, Darktrace/Email actions outbound emails to stop unknown, accidental and malicious data loss.  

Traditional DLP solutions only take into account classified data, which relies on the manual input of labelling each data piece, or creating rules to catch pattern matches that try to stop data of certain types leaving the organization. But in today’s world of constantly changing data, regular expression and fingerprinting detection are no longer enough.

  • Human error – Because it understands normal for every user, Darktrace/Email can recognize cases of misdirected emails. Even if the data is correctly labelled or insensitive, Darktrace recognizes when the context in which it is being sent could be a case of data loss and warns the user.  
  • Unclassified data – Whereas traditional DLP solutions can only take action on classified data, Darktrace analyzes the range of data that is either pending labels or can’t be labeled with typical capabilities due to its understanding of the content and context of every email.  
  • Insider threat – If a malicious actor has compromised an account, data exfiltration may still be attempted on encrypted, intellectual property, or other forms of unlabelled data to avoid detection. Darktrace analyses user behaviour to catch cases of unusual data exfiltration from individual accounts.

And classification efforts already in place aren’t wasted – Darktrace/Email extends Microsoft Purview policies and sensitivity labels to avoid duplicate workflows for the security team, combining the best of both approaches to ensure organizations maintain control and visibility over their data.

End User and Security Workflows

Achieve more than 60% improvement in the quality of end-user phishing reports and detection of sophisticated malicious weblinks1

Darktrace/Email improves end-user reporting from the ground up to save security team resource. Employees will always be on the front line of email security – while other solutions assume that end-user reporting is automatically of poor quality, Darktrace prioritizes improving users’ security awareness to increase the quality of end-user reporting from day one.  

Users are empowered to assess and report suspicious activity with contextual banners and Cyber AI Analyst generated narratives for potentially suspicious emails, resulting in 60% fewer benign emails reported.  

Out of the higher-quality emails that end up being reported, the next step is to reduce the amount of emails that reach the SOC. Darktrace/Email’s Mailbox Security Assistant automates their triage with secondary analysis combining additional behavioral signals – using x20 more metrics than previously – with advanced link analysis to detect 70% more sophisticated malicious phishing links.2 This directly alleviates the burden of manual triage for security analysts.

For the emails that are received by the SOC, Darktrace/Email uses automation to reduce time spent investigating per incident. With live inbox view, security teams gain access to a centralized platform that combines intuitive search capabilities, Cyber AI Analyst reports, and mobile application access. Analysts can take remediation actions from within Darktrace/Email, eliminating console hopping and accelerating incident response.

Darktrace takes a user-focused and business-centric approach to email security, in contrast to the attack-centric rules and signatures approach of secure email gateways

Microsoft Teams

Detect threats within your Teams environment such as account compromise, phishing, malware and data loss

Around 83% of Fortune 500 companies rely on Microsoft Office products and services, particularly Teams and SharePoint.3

Darktrace now leverages the same behavioral AI techniques for Microsoft customers across 365 and Teams, allowing organizations to detect threats and signals of account compromise within their Teams environment including social engineering, malware and data loss.  

The primary use case for Microsoft Teams protection is as a potential entry vector. While messaging has traditionally been internal only, as organizations open up it is becoming an entry vector which needs to be treated with the same level of caution as email. That’s why we’re bringing our proven AI approach to Microsoft Teams, that understands the user behind the message.  

Anomalous messaging behavior is also a highly relevant indicator of whether a user has been compromised. Unlike other solutions that analyze Microsoft Teams content which focus on payloads, Darktrace goes beyond basic link and sandbox analysis and looks at actual user behavior from both a content and context perspective. This linguistic understanding isn’t bound by the requirement to match a signature to a malicious payload, rather it looks at the context in which the message has been delivered. From this analysis, Darktrace can spot the early symptoms of account compromise such as early-stage social engineering before a payload is delivered.

Lateral Mail Analysis

Detect and respond to internal mailflow with multi-layered AI to prevent account takeover, lateral phishing and data leaks

The industry’s most robust account takeover protection now prevents lateral mail account compromise. Darktrace has always looked at internal mail to inform inbound and outbound decisions, but will now elevate suspicious lateral mail behaviour using the same AI techniques for inbound, outbound and Teams analysis.

Darktrace integrates signals from across the entire mailflow and communication patterns to determine symptoms of account compromise, now including lateral mailflow

Unlike other solutions which only analyze payloads, Darktrace analyzes a whole range of signals to catch lateral movement before a payload is delivered. Contributing yet another layer to the AI behavioral profile for each user, security teams can now use signals from lateral mail to spot the early symptoms of account takeover and take autonomous actions to prevent further compromise.

DMARC

Gain in-depth visibility and control of 3rd parties using your domain with an industry-first AI-assisted DMARC

Darktrace has created the easiest path to brand protection and compliance with the new Darktrace/DMARC. This new capability continuously stops spoofing and phishing from the enterprise domain, while automatically enhancing email security and reducing the attack surface.

Darktrace/DMARC helps to upskill businesses by providing step by step guidance and automated record suggestions provide a clear, efficient road to enforcement. It allows organizations to quickly achieve compliance with requirements from Google, Yahoo, and others, to ensure that their emails are reaching mailboxes.  

Meanwhile, Darktrace/DMARC helps to reduce the overall attack surface by providing visibility over shadow-IT and third-party vendors sending on behalf of an organization’s brand, while informing recipients when emails from their domains are sent from un-authenticated DMARC source.

Darktrace/DMARC integrates with the wider Darktrace product platform, sharing insights to help further secure your business across Email Attack Path and Attack Surface management.

Schlussfolgerung

To learn more about the new innovations to Darktrace/Email download the solution brief here.

All of the new updates to Darktrace/Email sit within the new Darktrace ActiveAI Security Platform, creating a feedback loop between email security and the rest of the digital estate for better protection. Click to read more about the Darktrace ActiveAI Security Platform or to hear about the latest innovations to Darktrace/OT, the most comprehensive prevention, detection, and response solution purpose built for critical infrastructures.  

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.

References

[1] Internal Darktrace Research

[2] Internal Darktrace Research

[3] Essential Microsoft Office Statistics in 2024

Continue reading
About the author
Carlos Gray
Product Manager

Blog

Keine Artikel gefunden.

Managing Risk Beyond CVE Scores With the Latest Innovations to Darktrace/OT

Standard-BlogbildStandard-Blogbild
09
Apr 2024

Identifying Cyber Risk in Industrial Organizations

Compromised OT devices in ICS and SCADA environments pose significant physical risks, even endangering lives. However, identifying CVEs in the multitude of complex OT devices is labor-intensive and time-consuming, draining valuable resources.

Even after identifying a vulnerability, implementing a patch presents its own challenges limited maintenance windows and the need for uninterrupted operations strain IT and OT teams often leading organizations to prioritize availability over security leading vulnerabilities remaining unresolved for over 5 years on average. (1)

Darktrace’s New Innovation

Darktrace is an industry leader in cybersecurity with 10+ years of experience securing OT environments where we take a fundamentally different approach using Self-Learning AI to enhance threat detection and response.

Continuing to combat the expanding threat landscape, Darktrace is excited to announce new capabilities that enable a contextualized and proactive approach to managing cyber risk at industrial organizations.

Today we launch an innovation to our OT Cybersecurity solution, Darktrace/OT, that will add a layer of proactivity, enabling a comprehensive approach to risk management. This industry leading innovation for Darktrace/OT moves beyond CVE scores to redefine vulnerability management for critical infrastructure, tackling the full breadth of risks not limited by traditional controls.  

Darktrace/OT is the only OT security solution with comprehensive Risk Management which includes:

  • Contextualized risk analysis unique to your organization
  • The most realistic evaluation and prioritization of OT risk
  • Effectively mitigate risk across your OT infrastructure, with and without patching.
  • The only OT security solution that evaluates your defenses against Advanced Persistent Threat (APT) Groups.

The most comprehensive prevention, detection, and response solution purpose built for Critical Infrastructures

Darktrace’s Self-Learning AI technology is a cutting-edge innovation that implements real time prevention, detection, response, and recovery for operational technologies and enables a fundamental shift from the traditional approach to cyber defense by learning a ‘pattern of life’ for every network, device, and user.  

Rather than relying on knowledge of past attacks, AI technology learns what is ‘normal’ for its environment, discovering previously unknown threats by detecting subtle shifts in behavior. Through identifying these unexpected anomalies, security teams can investigate novel attacks, discover blind spots, have live time visibility across all their physical and digital assets, and reduce time to detect, respond to, and triage security events.  

  • Achieve greater visibility of OT and IT devices across all levels of the Purdue Model.
  • The industry's only OT security to scale threat detection and response, with a 92% time saving from triage to recovery.  
  • The only OT focused security solution to provide bespoke Risk Management.

To learn more about how Darktrace/OT approaches unique use cases for industrial organizations visit the Darktrace/OT Webpage or join us LIVE at a city near you.

Read more below to discover how new innovations to Darktrace/OT are bringing a new, contextualized approach to Risk Management for Industrial organizations.

For more information on the entire Darktrace/OT Solution read our solution brief here.

Darktrace/OT and New Risk Management

Risk Identification

Leveraging the visibility of Darktrace/OT which identifies individual systems throughout the Purdue Model and the relationship between them, Darktrace/OT identifies high-risk CVEs and presents potential attack routes that go beyond techniques requiring a known exploit, such as misuse of legitimate services. Each attack path will have a mathematical evaluation of difficulty and impact from initial access to the high value objectives.  

Together this gives comprehensive coverage over your real and potential risks from both an attacker and known vulnerability perspectives. OT attack paths as seen here even leverage insights between the industrial and corporate communications to reveal ways threat actors may take advantage of IT-OT convergence. This revelation of imperceptible risks fills gaps in traditional risk analysis like remote access and insider threats.

Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 2: A specific Attack Path identified by Darktrace/OT

Risk Prioritization

Darktrace/OT prioritizes remediations and mitigations based on difficulty and damage to your unique organization, using the established Attack Paths.

We ascertain the priorities that apply to your organization beyond pure theoretical damage answering questions like:

  • How difficult is a particular vulnerability to exploit considering the steps an attacker would require to reach it?
  • And, how significant would the impact be if it was exploited within this particular network?

This expanded approach to risk prioritization has a much more comprehensive evaluation of your organization's unique risk than has ever been possible before. Traditional approaches of ranking only known vulnerabilities with isolated scores using CVSS and exploitability metrics, often leaves gaps in IT-OT risks and is blind to legitimate service exploitation.

Figure 3: Darktrace/OT leverages its contextual understand of the organization’s network to prioritize remediation that will have the positive impact on the risk score

Darktrace provides mitigation strategies associated with each identified risk and the relevant impact it has on your overall risk posture, across all MITRE ATT&CK techniques.

What sets Darktrace apart is our ability to contextualize these mitigations within the broader business. When patching vulnerabilities directly isn’t possible, Darktrace identifies alternative actions that harden attack paths leading to critical assets. Hardening the surrounding attack path increases the difficulty and therefore reduces the likelihood and impact of a breach.

That means unpatched vulnerabilities and vulnerable devices aren’t left unprotected. This also has an added bonus, those hardening techniques work for all devices in that network segment, so apply one change, secure many.

Figure 4: Darktrace prioritizes mitigation reducing accessibility of vulnerability and the overall risk score when patches aren’t available

Communicate Board Level Risk with APT Threat Mapping

Darktrace/OT bridges theory and practice as the only security solution that maps MITRE techniques, frequently used by APT Groups, onto AI-assessed critical Attack Paths. This unique solution provides unparalleled insights including sector and location intelligence, possible operating platforms, common techniques, exploited CVEs, and the number of potential devices affected in your environment, supporting holistic risk assessment and proactive defense measures.

Ultimately, this becomes a power dashboard to communicate board level risk, using both metric based evidence and industry standard threat mapping.

Schlussfolgerung

Darktrace/OT is part of the Darktrace ActiveAI Security Platform a native, holistic, AI-driven platform built on over ten years of AI research. It helps security teams shift to more a productive mode, finding the known and the unknown attacks and transforming the SOC with the various Darktrace products to drive efficiency gains. It does this across the whole incident lifecycle to lower risk, reduce time spent on active incidents, and drive return on investment.

Discover more about Darktrace's ever-strengthening platform with the upcoming changes coming to our Darktrace/Email product and other launch day blogs.

Join Darktrace LIVE half-day event to understand the reality versus the hype surrounding AI and how to achieve cyber resilience.

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.  

References

1. https://research-information.bris.ac.uk/ws/portalfiles/portal/313646831/Catch_Me_if_You_Can.pdf

Continue reading
About the author
Mitchell Bezzina
VP, Product and Solutions Marketing
Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Starten Sie Ihren kostenlosen Test
Darktrace AI protecting a business from cyber threats.