Blog
/

Thought Leadership

/
November 29, 2022

How to Cut Through Cyber Security Noise

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
29
Nov 2022
Learn how Cyber AI Analyst tackles alert fatigue by categorizing vast amounts of data into actionable security incidents for your team's review.

For cyber security experts, it’s hard enough staying on top of the latest threats and emerging attacks without having to deal with a virtual tsunami of alert noise from systems monitoring email, SaaS environments, and endpoints – in addition to IaaS cloud and on-premises networks. Unfortunately, fatigue from these demands can lead to overworking, burnout, and crucially, high employee turnover. 

The worldwide industry shortage of 3.5 million cyber security professionals only exacerbates the problem. Not only does it add pressure to the current stock of skilled and available security professionals, but it also raises the stakes for CISOs and other security leaders to find a way to cut through the alert noise while staying on ahead of threat actors who never stop innovating and applying novel malware strains and attack techniques.

Working Smarter Not Harder

One way to help with retention is to empower security teams to break away from monotony and to think creatively and leverage their expertise where it can really add value. Working smarter, rather than harder, is often easier said than done, but by employing automation and AI-driven tools to take on the heavy lifting of threat detection, investigation, and response, human teams can be given the breathing room needed to focus on long-term objectives and think more deeply about their security approaches.

It is important for security programs to continuously level up alongside evolving threat landscapes by questioning existing security operations, and this cannot be achieved during times of hand-to-hand alert combat.

When alerts are fewer, higher quality, and context-heavy, the background to each can be easily explored, whether that’s reevaluating a policy or configuration, or simply asking useful questions around the company’s broader security approach. Work done at this level empowers security teams and fosters growth.

Less is More

Business risk– or the potential impact of cyber disruption– should be the number one concern driving a security team, but lack of resources is a near-constant constraint. Reducing the volume of alerts doesn’t just mean bringing the noise floor up. You can think of the noise floor as an alert threshold: if it is too high then there are fewer alerts, but more threats may be missed, whereas if it is too low, there are high volumes of unhelpful false positives. Freeing up time for the team must not equate to ignoring alerts; it should instead mean focusing on the alerts that matter.

Darktrace’s technologies make this possible, with Darktrace DETECT™ and Cyber AI Analyst working together to address alert fatigue and burnout for security teams while strengthening an organizations’ overall security posture. Cyber AI Analyst essentially takes over the busy work from the human analysts and elevates a team’s overall decision making. Teams now operate at higher levels, as they’re not stuck in mundane alert management and humans are brought in only after the machine and AI have done the heavy lifting.

“Before AI Analyst, we were barely treading water with all of the alerts, most of which were false positives, our old systems produced daily. With AI Analyst, we’ve been able to exponentially reduce those alerts, harden our environment, and get strategic.”

Dr. Robert Spangler, the CISO and Assistant Executive Director of the New Jersey State Bar Association.

Figure 1: Billions of individual events are reduced into a critical incident for review


Imagine a scenario in which Darktrace observed around 9.6 billion events over a 28-day period. DETECT and Cyber AI Analyst might distill that huge amount of data down into just, say, 54 critical incidents, or just two per day. Here’s how:

9.6 billion events

When trying to understand the full picture, every single puzzle piece counts. That’s why Darktrace’s Self-Learning AI goes wherever your organization has data, integrating with data sources across the digital estate, including network, email, endpoints, OT, cloud, and SaaS environments. And with an open architecture, Darktrace facilitates quick and easy integrations with everything from SIEMs and SOARs to public clouds and the latest Zero Trust technologies. So, any data can become learnable, whether directly ingested or via integration.

By examining this full and contextualized data set, Self-Learning AI builds a constantly evolving understanding of what ‘normal’ looks like for the entire organization. Every connection, every email, app login, resource accessed, VM spun up, PLC reprogrammed, and more become signals from which Darktrace can learn, evaluate, and improve its understanding.

40,404 model breaches

The billions of events are analyzed by Darktrace DETECT, which uses its extensive knowledge of ‘normal’ to draw out hosts of subtle anomalies or ‘AI model breaches.’ Many of these AI model breaches will be weak indicators of threatening activity, and most will not be sufficient to individually signal a threat. For that reason, no human attention is required at this stage. Darktrace DETECT will continue to draw anomalous behaviors from the ongoing stream of events without the need for intervention. 

200 incidents

The Cyber AI Analyst takes the total list of model breaches collated by DETECT and performs the truly sophisticated work of determining distinct threat incidents. By piecing together anomalies which may, in themselves, appear harmless, the AI Analyst draws out subtle and often wide-ranging attacks, tracking their route from the initial compromise to the present moment. This creates a much shorter list of genuine threat incidents, but there is still no need for human attention at this stage.

54 critical incidents

Once it has discovered the threat incidents facing an organization, the Cyber AI Analyst begins the crucial processes of triage to determine which incidents need to be surfaced to the security team, and in what order of priority. This supplies the human team with a highly focused briefing of the most pressing threats, massively reducing their overall workload and minimizing or potentially eradicating alert fatigue. In the above example of a month with over 9.6 billion distinct events, the team are left with just two incidents to address per day. These two incidents are clearly presented with natural language-processing and all the most relevant info, including details, devices, and dates. 

“When we had other, noisier systems, we didn’t have the time to have truly in-depth discussions or conduct deep investigations, so there were fewer teachable moments for junior team members and fewer opportunities to inform our cybersecurity strategy as a whole,” Spangler said. “Now, we’re not just a better team, we’re more efficient, responsive, and informed than we’ve ever been. We’re all better cyber security professionals as a result.”

In the event of a breach, CISOs and security leaders want the full incident report, and they want it yesterday. The promise of AI is to handle specific tasks at a speed and scale that humans can’t. Going from 9.6 billion events to 54 incidents demonstrates the scale, but it’s important to consider the impact of speed here as well, as the Cyber AI Analyst works in real time, meaning all relevant events are presented in an easy to consume downloadable report available immediately upon investigation.

This isn’t a black box either; every step of the AI Analyst’s investigation process is visible to the human team. Not only can they see the relevant events and breaches that led to the incident, but if required, they can pivot into them easily with a click. If the investigation requires going all the way down to the metadata level to easily peruse the filtered events of the 9.6 billion overall signals or even to PCAP data, those are available and easy to find too.

Since DETECT and Cyber AI Analyst not only reduce alert fatigue but also simplify incident investigations, security teams feel empowered and experience less burnout. 

“We’ve been stable and have had minimal turnover since we started using AI Analyst,” Spangler said. “We’re not scrambling to keep up with noisy and time-consuming false positives, making the investigations that we undertake stimulating and– I say this cautiously– fun! Put simply, the thing we all love about this career, the virtual chess game we play with attackers, is a lot more fun when you know you’re going to win.”

Autonomous Response

Organizations that deploy Darktrace RESPOND™ can address the incidents raised by DETECT and the Cyber AI Analyst autonomously, and in mere seconds. Using the full context of the organization built up by Self-Learning AI, RESPOND takes the least disruptive measures necessary to disarm threats at machine speed. By the time the security team learns about the attack, it is already contained, continuing to save them from the hand-to-hand combat of threat fighting.

With day-to-day threat detection, response, and analysis taken care of, security teams are free to give full and sustained attention to their overall security posture. Neutralized threats may yet reveal broader security gaps and potential improvements which the team now has the time and headspace to pursue.

For example, discovering a trend that users are uploading potentially sensitive data via third-party file-sharing services might lead to a discussion about whether it should be company policy to block access to this service, reducing to zero the number of future alerts that would have been triggered by this behavior. Importantly, this wouldn’t be altering the aforementioned noise floor, but instead fundamentally altering security policies to align with the needs of the business, which could indirectly affect future alerting, as activities may subside.

As a result, practitioners find more value in their work, security teams efforts are optimized, and organizations are strengthened overall.

“We’re now focused on the items that AI Analyst alerts us to, which are always worth looking into because they either identify an activity that we need to get eyes on and/or provide us with insight into ways we can harden our network,” Spangler said. “The hardening that we’ve done has been incalculably beneficial– it’s one of the reasons we get fewer alerts, and it’s also protected us against a wide variety of threats.”

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Dan Fein
VP, Product

Based in New York, Dan joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s product suite. Dan has a particular focus on Darktrace/Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.

Elliot Stocker
Product SME

After 2 years in a commercial role helping to deploy Darktrace across a broad range of digital environments, Elliot currently occupies the role of Product Subject Matter Expert, where he helps to articulate the value of Darktrace’s technology to customers around the world. Elliot holds a Masters degree in Data Science and Machine Learning, using this knowledge to communicate concepts around machine learning and AI in an accessible way to different audiences.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

November 28, 2024

/

Cloud

Cloud security: addressing common CISO challenges with advanced solutions

Default blog imageDefault blog image

Cloud adoption is a cornerstone of modern business with its unmatched potential for scalability, cost efficiency, flexibility, and net-zero targets around sustainability. However, as organizations migrate more workloads, applications, and sensitive data to the cloud it introduces more complex challenges for CISO’s. Let’s dive into the most pressing issues keeping them up at night—and how Darktrace / CLOUD provides a solution for each.

1. Misconfigurations: The Silent Saboteur

Misconfigurations remain the leading cause of cloud-based data breaches. In 2023 alone over 80%  of data breaches involved data stored in the cloud.1  Think open storage buckets or overly permissive permissions; seemingly minor errors that are easily missed and can snowball into major disasters. The fallout of breaches can be costly—both financially and reputationally.

How Darktrace / CLOUD Helps:

Darktrace / CLOUD continuously monitors your cloud asset configurations, learning your environment and using these insights to flag potential misconfigurations. New scans are triggered when changes take place, then grouped and prioritised intelligently, giving you an evolving and prioritised view of vulnerabilities, best practice and mitigation strategies.

2. Hybrid Environments: The Migration Maze

Many organizations are migrating to the cloud, but hybrid setups (where workloads span both on-premises and cloud environments) create unique challenges and visibility gaps which significantly increase complexity. More traditional and most cloud native security tooling struggles to provide adequate monitoring for these setups.

How Darktrace / CLOUD Helps:

Provides the ability to monitor runtime activity for both on-premises and cloud workloads within the same user interface. By leveraging the right AI solution across this diverse data set, we understand the behaviour of your on-premises workloads and how they interact with cloud systems, spotting unusual connectivity or data flow activity during and after the migration process.

This unified visibility enables proactive detection of anomalies, ensures seamless monitoring across hybrid environments, and provides actionable insights to mitigate risks during and after the migration process.

3. Securing Productivity Suites: The Last Mile

Cloud productivity suites like Microsoft 365 (M365) are essential for modern businesses and are often the first step for an organization on a journey to Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) use cases. They also represent a prime target for attackers. Consider a scenario where an attacker gains access to an M365 account, and proceeds to; access sensitive emails, downloading files from SharePoint, and impersonating the user to send phishing emails to internal employees and external partners. Without a system to detect these behaviours, the attack may go unnoticed until significant damage is done.

How Darktrace helps:

Darktrace’s Active AI platform integrates with M365 and establishes an understanding of normal business activity, enabling the detection of abnormalities across its suite including Email, SharePoint and Teams. By identifying subtle deviations in behaviour, such as:

   •    Unusual file accesses

   •    Anomalous login attempts from unexpected locations or devices.

   •    Suspicious email forwarding rules created by compromised accounts.

Darktrace’s Autonomous Response can act precisely to block malicious actions, by disabling compromised accounts and containing threats before they escalate. Precise actions also ensure that critical business operations are maintained even when a response is triggered.  

4. Agent Fatigue: The Visibility Struggle

To secure cloud environments, visibility is critical. If you don’t know what’s there, how can you secure it? Many solutions require agents to be deployed on every server, workload, and endpoint. But managing and deploying agents across sprawling hybrid environments can be both complex and time-consuming when following change controls, and especially as cloud resources scale dynamically.

How Darktrace / CLOUD Helps:

Darktrace reduces or eliminates the need for widespread agent deployment. Its agentless by default, integrating directly with cloud environments and providing instant visibility without the operational headache. Darktrace ensures coverage with minimal friction. By intelligently graphing the relationships between assets and logically grouping your deployed Cloud resources, you are equipped with real-time visibility to quickly understand and protect your environment.

So why Darktrace / CLOUD?

Darktrace’s Self-Learning AI redefines cloud security by adapting to your unique environment, detecting threats as they emerge, and responding in real-time. From spotting misconfigurations to protecting productivity suites and securing hybrid environments. Darktrace / CLOUD simplifies cloud security challenges without adding operational burdens.

From Chaos to Clarity

Cloud security doesn’t have to be a game of endless whack-a-mole. With Darktrace / CLOUD, CISOs can achieve the visibility, control, and proactive protection they need to navigate today’s complex cloud ecosystems confidently.

[1] https://hbr.org/2024/02/why-data-breaches-spiked-in-2023

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security

Blog

/

November 27, 2024

/

Inside the SOC

Behind the veil: Darktrace's detection of VPN exploitation in SaaS environments

Default blog imageDefault blog image

Introduction

In today’s digital landscape, Software-as-a-Service (SaaS) platforms have become indispensable for businesses, offering unparalleled flexibly, scalability, and accessibly across locations. However, this convenience comes with a significant caveat - an expanded attack surface that cyber criminals are increasingly exploiting. In 2023, 96.7% of organizations reported security incidents involving at least one SaaS application [1].

Virtual private networks (VPNs) play a crucial role in SaaS security, acting as gateways for secure remote access and safeguarding sensitive data and systems when properly configured. However, vulnerabilities in VPNs can create openings for attacks to exploit, allowing them to infiltrate SaaS environments, compromise data, and disrupt business operations. Notably, in early 2024, the Darktrace Threat Research team investigated the exploitation of zero-day vulnerabilities in Ivanti Connect Secure VPNs, which would allow threat actors to gain access to sensitive systems and execute remote code.

More recently, in August, Darktrace identified a SaaS compromise where a threat actor logged into a customer’s VPN from an unusual IP address, following an initial email compromise. The attacker then used a separate VPN to create a new email rule designed to obfuscate the phishing campaign they would later launch.

Attack Overview

The initial attack vector in this case appeared to be through the customer’s email environment. A trusted external contact received a malicious email from another mutual contact who had been compromised and forwarded it to several of the organization’s employees, believing it to be legitimate. Attackers often send malicious emails from compromised accounts to their past contacts, leveraging the trust associated with familiar email addresses. In this case, that trust caused an external victim to unknowingly propagate the attack further. Unfortunately, an internal user then interacted with a malicious payload included in the reply section of the forwarded email.

Later the same day, Darktrace / IDENTITY detected unusual login attempts from the IP 5.62.57[.]7, which had never been accessed by other SaaS users before. There were two failed attempts prior to the successful logins, with the error messages “Authentication failed due to flow token expired” and “This occurred due to 'Keep me signed in' interrupt when the user was signing in.” These failed attempts indicate that the threat actor may have been attempting to gain unauthorized access using stolen credentials or exploiting session management vulnerabilities. Furthermore, there was no attempt to use multi-factor authentication (MFA) during the successful login, suggesting that the threat actor had compromised the account’s credentials.

Following this, Darktrace detected the now compromised account creating a new email rule named “.” – a telltale sign of a malicious actor attempting to hide behind an ambiguous or generic rule name.

The email rule itself was designed to archive incoming emails and mark them as read, effectively hiding them from the user’s immediate view. By moving emails to the “Archive” folder, which is not frequently checked by end users, the attacker can conceal malicious communications and avoid detection. The settings also prevent any automatic deletion of the rules or forced overrides, indicating a cautious approach to maintaining control over the mailbox without raising suspicion. This technique allows the attacker to manipulate email visibility while maintaining a façade of normality in the compromised account.

Email Rule:

  • AlwaysDeleteOutlookRulesBlob: False
  • Force: False
  • MoveToFolder: Archive
  • Name: .
  • MarkAsRead: True
  • StopProcessingRules: True

Darktrace further identified that this email rule had been created from another IP address, 95.142.124[.]42, this time located in Canada. Open-source intelligence (OSINT) sources indicated this endpoint may have been malicious [2].

Given that this new email rule was created just three minutes after the initial login from a different IP in a different country, Darktrace recognized a geographic inconsistency. By analyzing the timing and rarity of the involved IP addresses, Darktrace identified the likelihood of malicious activity rather than legitimate user behavior, prompting further investigation.

Figure 1: The compromised SaaS account making anomalous login attempts from an unusual IP address in the US, followed by the creation of a new email rule from another VPN IP in Canada.

Just one minute later, Darktrace observed the attacker sending a large number of phishing emails to both internal and external recipients.

Figure 2: The compromised SaaS user account sending a high volume of outbound emails to new recipients or containing suspicious content.

Darktrace / EMAIL detected a significant spike in inbound emails for the compromised account, likely indicating replies to phishing emails.

Figure 3: The figure demonstrates the spike in inbound emails detected for the compromised account, including phishing-related replies.

Furthermore, Darktrace identified that these phishing emails contained a malicious DocSend link. While docsend[.]com is generally recognized as a legitimate file-sharing service belonging to Dropbox, it can be vulnerable to exploitation for hosting malicious content. In this instance, the DocSend domain in question, ‘hxxps://docsend[.]com/view/h9t85su8njxtugmq’, was flagged as malicious by various OSINT vendors [3][4].

Figure 4: Phishing emails detected containing a malicious DocSend link.

In this case, Darktrace Autonomous Response was not in active mode in the customer’s environment, which allowed the compromise to escalate until their security team intervened based on Darktrace’s alerts. Had Autonomous Response been enabled during the incident, it could have quickly mitigated the threat by disabling users and inbox rules, as suggested by Darktrace as actions that could be manually applied, exhibiting unusual behavior within the customer’s SaaS environment.

Figure 5: Suggested Autonomous Response actions for this incident that required human confirmation.

Despite this, Darktrace’s Managed Threat Detection service promptly alerted the Security Operations Center (SOC) team about the compromise, allowing them to conduct a thorough investigation and inform the customer before any further damage could take place.

Conclusion

This incident highlights the role of Darktrace in enhancing cyber security through its advanced AI capabilities. By detecting the initial phishing email and tracking the threat actor's actions across the SaaS environment, Darktrace effectively identified the threat and brought it to the attention of the customer’s security team.

Darktrace’s proactive monitoring was crucial in recognizing the unusual behavior of the compromised account. Darktrace / IDENTITY detected unauthorized access attempts from rare IP addresses, revealing the attacker’s use of a VPN to hide their location.

Correlating these anomalies allowed Darktrace to prompt immediate investigation, showcasing its ability to identify malicious activities that traditional security tools might miss. By leveraging AI-driven insights, organizations can strengthen their defense posture and prevent further exploitation of compromised accounts.

Credit to Priya Thapa (Cyber Analyst), Ben Atkins (Senior Model Developer) and Ryan Traill (Analyst Content Lead)

Appendices

Real-time Detection Models

  • SaaS / Compromise / Unusual Login and New Email Rule
  • SaaS / Compromise / High Priority New Email Rule
  • SaaS / Compromise / New Email Rule and Unusual Email Activity
  • SaaS / Compromise / Unusual Login and Outbound Email Spam
  • SaaS / Compliance / Anomalous New Email Rule
  • SaaS / Compromise / Suspicious Login and Suspicious Outbound Email(s)
  • SaaS / Email Nexus / Possible Outbound Email Spam

Autonomous Response Models

  • Antigena / SaaS / Antigena Email Rule Block
  • Antigena / SaaS / Antigena Enhanced Monitoring from SaaS User Block
  • Antigena / SaaS / Antigena Suspicious SaaS Activity Block

MITRE ATT&CK Mapping

Technique Name Tactic ID Sub-Technique of

  • Cloud Accounts. DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS T1078.004 T1078
  • Compromise Accounts RESOURCE DEVELOPMENT T1586
  • Email Accounts RESOURCE DEVELOPMENT T1586.002 T1586
  • Internal Spearphishing LATERAL MOVEMENT T1534 -
  • Outlook Rules PERSISTENCE T1137.005 T1137
  • Phishing INITIAL ACCESS T1566 -

Indicators of Compromise (IoCs)

IoC – Type – Description

5.62.57[.]7 – Unusual Login Source

95.142.124[.]42– IP – Unusual Source for Email Rule

hxxps://docsend[.]com/view/h9t85su8njxtugmq - Domain - Phishing Link

References

[1] https://wing.security/wp-content/uploads/2024/02/2024-State-of-SaaS-Report-Wing-Security.pdf

[2] https://www.virustotal.com/gui/ip-address/95.142.124.42

[3] https://urlscan.io/result/0caf3eee-9275-4cda-a28f-6d3c6c3c1039/

[4] https://www.virustotal.com/gui/url/8631f8004ee000b3f74461e5060e6972759c8d38ea8c359d85da9014101daddb

Continue reading
About the author
Priya Thapa
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI