WIXLIB

Cyber Threat AnalyticsOn thisThe Cyber Threat Analytics app monitors security logs and network flows to detectmalware infections (for example, zero day attacks and ransomware), systemcompromise, lateral movement, pass-the-hash, pass-the-ticket, and other advancedthreats. SNYPR ingests data from sources such as firewalls, proxy, VPN, IDS, DNS,endpoints, and Netflow devices to baseline normal behavior and detect maliciouspatterns such as beaconing; connections to digitally generated domains; roboticbehavior; rare executables; and programs, lateral connections, and unusual webactivity.Actionable Security IntelligenceThe Securonix platform mines, enriches, and transforms SIEM events from HPArcSight, IBM Radar, McAfee ESM, Splunk, and others into actionable intelligence onthreats against the entire IT environment including critical business applications.Securonix integrates with SIEM products through a direct API connection, syslog, or adatabase connection where it picks up activity and event data. The platform hasconnectors leading to HR and identity management systems, bringing in more than 75standard and custom identity attributes, and pulls in detailed activity and entitlementinformation for application level deep monitoring from enterprise managementsystems such as SAP, SharePoint, and EPIC.Business ImpactFaster breach detectionReduce breach impactComprehensive threat response and investigationLower monitoring and management costsLower compliance costsReceive quantified, non-subjective threat and risk reportingKey Use CasesAnomalous program execution (rare process, path, MD5)Robotic traffic pattern to a malicious, uncategorized, or suspicious websiteSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 074859209661/20

CybAnalyticsConnections to digitally generated domainsUnusual DNS queriesPossible command and control (C&C) activitySpike in bytes out to external destinationsUnusual traffic pattern (application / port)Anglr exploit detectionsRare user agentsUnusual session durationConnections to blacklisted IP or domainsDDOS / port scan activityAbnormal number of failed or redirected requestsTargeted SPAM / phishing attemptsKey Threat ModelsMultiple threat indicators that occur in a pattern and involve similar entities tend tohave a much higher risk of being a real threat. Threat Models define these patterns,and combine policies and threat indicators to detect related behavior across multipledata sources to detect threats that might otherwise go unnoticed.Threat Model NameDescriptionLATERAL MOVEMENTDETECTIONThis threatmodel detectspossiblenetwork lateralmovementscenarioswhich aredeployed byattackers toprogressivelyspread througha network asthey search forkey assets anddataStageThreat IndicatorsAccount accessing ahost never accessedbeforeHost enumerationdetectedAUTHENTICATIONANOMALYUse of explicitaccount credentialsacross multiple nomalousprovisioning activitydetectedSUSPICIOUS USEOF PRIVILEGESSuspicious escalationof privilegesdetectedAnomalous networkshare objectsaccessedPROCESSANOMALYSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 07485920966Rare process/MD5detected2/20

Threat Model NameDescriptionStageThreat IndicatorsSuspicious creationof scheduled tasksSuspicious changesto registry settingdetectedTraffic to randomlygenerated domainsCOMPROMISED HOSTDETECTIONThis threatmodel aims toidentify hoststhat show signsof infectionandcompromise bycorrelatinghost andnetwork basedanomalies onthe same entityOUTBOUNDTRAFFICANOMALYTraffic to knownmalicious hostsdetectedAbnormal number ofrare domainsaccessedPossible C2communicationdetectedRare rotocol usageby process detectedRare user agentdetectedAPT DETECTIONThis threatmodel aims toidentifystealthycomputernetworkattacks inwhich amalicious actorgainsunauthorizedaccess to anetwork withan intention toremainundetected foran extendedperiodPossible phishingattemptRECONNetwork scanningand enumerationdetectedCircumvention ofcontrols detectedTraffic to randomlygenerated domainsDELIVERYDHCP trafficanomaly detectedTraffic to knownmalicious hostsdetectedEXPLOITActivity byterminated/dormantaccounts detectedDNS traffic sdetectedAccount accessing ahost never accessedbeforeSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 074859209663/20

Threat Model NameDescriptionStageThreat IndicatorsLandspeed anomalydetectedRare process/MD5detectedPossible C2communicationdetectedEXECUTEDNS amplificationanomalyCovert channelexfiltration detectedEXFILTRATIONPHISHINGThis threatmodel aims toidentifypossiblephishingattempts totarget userswithin theorganizationData egress vianetwork uploadsdetectedDetection oftargeted/spearphishing campaignsDetection of possiblespray phishingSUSPICIOUSINBOUND EMAILDetection ofpersistent phishingcampaigns – Similarsender from multipledomainsEmails from on ofsuspicious emailattachmentsTraffic to randomlygenerated domainsTraffic to knownmalicious hostsdetectedOUTBOUNDTRAFFICANOMALYAbnormal number ofrare domainsaccessedPossible C2communicationdetectedSuspicious proxyredirects detectedSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 074859209664/20

Threat Model NameDescriptionStageThreat IndicatorsRare process/MD5detectedPROCESSANOMALYSuspicious creationof scheduled tasksSuspicious changesto registry settingdetectedRare process/MD5detectedSUSPICIOUSPROCESSEXECUTIONUse of possible ADenumeration toolsetsUse of malicioustools and utilitiesdetectedDetection of possibleAD account/privilegeenumerationHOST/ACCOUNT ENUMERATIONON LDAPThis threatmodel aims toidentifypotentialassets oraccountsenumerationon the networkby maliciousentitiesNETWORKSCANNINGDetection of LDAPor SMB servicesenumerationDetection ofabnormal number ofKerberos serviceticket requestsDetection of portscanningAccounts accessing ahost for the first timeAUTHENTICATIONANOMALYUse of previouslyunseen accounts onthe networkAbnormal number offailed authenticationrequestsDetection of possiblepassword sprayingRECON FOLLOWED BYPOTENTIAL EXPLOITATIONThis threatmodel aims ollowed byindicators ofexploitEXTERNAL SCANNETWORKSCANNINGSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 07485920966Port scan fromexternal hostsHost enumerationfrom external hostsDetection of possibleAD account/privilegeenumerationDetection of LDAPservicesenumeration5/20

Threat Model NameDescriptionStageThreat IndicatorsDetection ofabnormal number ofKerberos serviceticket requestsDetection of spike inLDAP trafficDetection of SMBservicesenumerationRare process/MD5detectedPROCESSANOMALYSuspicious creationof scheduled tasksSuspicious changesto registry settingdetectedAccount accessing ahost never accessedbeforeNETWORKSCANNINGDETECTIONAbnormal number ofSMBv1 networkactivitySMBv1 scanninganomaly detectionWANNACRY MALWAREDETECTIONThis targetedthreat modelaims to identifyWannacrymalwarebehaviorTraffic to raredomainsOUTBOUNDTRAFFICANOMALYTraffic to randomlygenerated domainsTraffic to knownmalicious hostsdetectedTraffic to TOR exitnodesRare process/MD5detectedPROCESSANOMALYSuspicious creationof scheduled tasksSuspicious changesto registry settingdetectedNETWORK ANOMALYFOLLOWED BY DATAEXFILTRATIONThis threatmodel aims toidentifysuccessfulnetwork dataaggregationattemptsfollowed bysigns of dataexfiltrationNETWORKSCANNINGSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 07485920966Detection of possibleAD account/privilegeenumerationDetection of LDAPservicesenumeration6/20

outside of theDescriptionnetworkThreat Model NameStageThreat IndicatorsDetection ofabnormal number ofKerberos serviceticket requestsDetection of spike inLDAP trafficDetection of SMBservicesenumerationRare network shareobject accessedNETWORK DRIVEANOMALYAbnormal number ofnetwork shareobjects accessedAdmin object accessanomalyDATAAGGREGATIONDATAEXFILTRATION VIANETWORKAbnormal amount ofbytes downloadedvia SMB PortsAbnormal amount ofbytes downloadedvia FTP PortsAbnormal amount ofbytes transmitted viaFTP PortsAbnormal amount ofbytes transmitted viacovert channelAccount accessing ahost never accessedbeforeNETWORKSCANNINGDETECTIONAbnormal number ofSMBv1 networkactivitySMBv1 scanninganomaly detectionPETRWRAP/GOLDENEYE/NYETYAMALWARE DETECTIONThis targetedthreat modelaims to DACTIVITYPossible privilegeescalationUnusual IPC Adminshare accessDetection of auditlog tamperingRare process/MD5detectedPROCESSANOMALYSuspicious creationof scheduled tasksSuspicious changesto registry settingdetectedSecure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 074859209667/20

Threat Model NameDescriptionStageThreat IndicatorsSuspicious ProcessExecutionBLOODHOUND CRITICAL ATTACKThis threatmodel aims toidentify usageof Bloodhoundlike utilitiesthat aretargetedtowards ActiveDirectoryenumerationMalicious ProcessDetectionRare ProcessCreationSuspiciousapplication detectedNetwork AnomalyOutbound AnomalyNetwork Scanningand EnumerationData aggregationover networkPossible C2communicationSuspicious ProcessExecutionSAMSAM - GOLDLOWELLRANSOMWARE ATTACKThis targetedthreat modelaims to identifySamsammalwarebehavior.MaliciousProcess DetectedSuspiciousApplication DetectedNetwork AnomalyOutbound AnomalySPECTRE MELTDOWN ATTACKThis targetedthreat modelaims to identifySpectremeltdownattackbehaviorRare processexecutionSuspicious ProcessDetectionNetwork Scanningand EnumerationData aggregationover networkPossible C2CommunicationSuspicious processexecutionRare processcreationData egress overcloud collaborationPossible C2CommunicationData aggregationover networkPossible C2communicationSupported Datasources by FunctionalityThe following datasources are recommended to run the applicable use cases in theapplication:FunctionalityDatasource(s)Secure Online Desktop s.r.l. - www.secure-od.comVia dell’Annunciata 27 – 20121 MilanoTel. 39 0522 16 85 330 - P.IVA 074859209668/20