Blog
/

Inside the SOC

/
January 31, 2024

How Darktrace Defeated SmokeLoader Malware

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
31
Jan 2024
Read how Darktrace's AI identified and neutralized SmokeLoader malware. Gain insights into their proactive approach to cybersecurity.

What is Loader Malware?

Loader malware is a type of malicious software designed primarily to infiltrate a system and then download and execute additional malicious payloads.

In recent years, loader malware has emerged as a significant threat for organizations worldwide. This trend is expected to continue given the widespread availability of many loader strains within the Malware-as-a-Service (MaaS) marketplace. The MaaS marketplace contains a wide variety of innovative strains which are both affordable, with toolkits ranging from USD 400 to USD 1,650 [1], and continuously improving, aiming to avoid traditional detection mechanisms.

SmokeLoader is one such example of a MaaS strain that has been observed in the wild since 2011 and continues to pose a significant threat to organizations and their security teams.

How does SmokeLoader Malware work?

SmokeLoader’s ability to drop an array of different malware strains onto infected systems, from backdoors, ransomware, cryptominers, password stealers, point-of-sale malware and banking trojans, means its a highly versatile loader that has remained consistently popular among threat actors.

In addition to its versatility, it also exhibits advanced evasion strategies that make it difficult for traditional security solutions to detect and remove, and it is easily distributed via methods like spam emails or malicious file downloads.

Between July and August 2023, Darktrace observed an increasing trend in SmokeLoader compromises across its customer base. The anomaly-based threat detection capabilities of Darktrace, coupled with the autonomous response technology, identified and contained the SmokeLoader infections in their initial stages, preventing attackers from causing further disruption by deploying other malicious software or ransomware.

SmokeLoader Malware Attack Details

PROPagate Injection Technique

SmokeLoader utilizes the PROPagate code injection technique, a less common method that inserts malicious code into existing processes in order to appear legitimate and bypass traditional signature-based security measures [2] [3]. In the case of SmokeLoader, this technique exploits the Windows SetWindowsSubclass function, which is typically used to add or change the behavior of Windows Operation System. By manipulating this function, SmokeLoader can inject its code into other running processes, such as the Internet Explorer. This not only helps to disguise  the malware's activity but also allows attackers to leverage the permissions and capabilities of the infected process.

Obfuscation Methods

SmokeLoader is known to employ several obfuscation techniques to evade the detection and analysis of security teams. The techniques include scrambling portable executable files, encrypting its malicious code, obfuscating API functions and packing, and are intended to make the malware’s code appear harmless or unremarkable to antivirus software. This allows attackers to slip past defenses and execute their malicious activities while remaining undetected.

Infection Vector and Communication

SmokeLoader typically spreads via phishing emails that employ social engineering tactics to convince users to unknowingly download malicious payloads and execute the malware. Once installed on target networks, SmokeLoader acts as a backdoor, allowing attackers to control infected systems and download further malicious payloads from command-and-control (C2) servers. SmokeLoader uses fast flux, a DNS technique utilized by botets whereby IP addresses associated with C2 domains are rapidly changed, making it difficult to trace the source of the attack. This technique also boosts the resilience of attack, as taking down one or two malicious IP addresses will not significantly impact the botnet's operation.

Continuous Evolution

As with many MaaS strains, SmokeLoader is continuously evolving, with its developers regularly adding new features and techniques to increase its effectiveness and evasiveness. This includes new obfuscation methods, injection techniques, and communication protocols. This constant evolution makes SmokeLoader a significant threat and underscores the importance of advanced threat detection and response capabilities solution.

Darktrace’s Coverage of SmokeLoader Attack

Between July and August 2023, Darktrace detected one particular SmokeLoader infection at multiple stages of its kill chain on a customer network. This detection was made possible by Darktrace DETECT’s anomaly-based approach and Self-Learning AI that allows it to identify subtle deviations in device behavior.

One of the key components of this process is the classification of endpoint rarity and determining whether an endpoint is new or unusual for any given network. This classification is applied to various aspects of observed endpoints, such as domains, IP addresses, or hostnames within the network. It thereby plays a vital role in identifying SmokeLoader activity, such as the initial infection vector or C2 communication, which typically involve a device contacting a malicious endpoint associated with SmokeLoader.

The First Signs of Infection SmokeLoader Infection

Beginning in July 2023, Darktrace observed a surge in suspicious activities that were assessed with moderate to high confidence to be associated with SmokeLoader malware.

For example on July 30, a device was observed making a successful HTTPS request to humman[.]art, a domain that had never been seen on the network, and therefore classified as 100% rare by DETECT. During this connection, the device in question received a total of 6.0 KiB of data from the unusual endpoint. Open-source intelligence (OSINT) sources reported with high confidence that this domain was associated with the SmokeLoader C2 botnet.

The device was then detected making an HTTP request to another 100% rare external IP, namely 85.208.139[.]35, using a new user agent. This request contained the URI ‘/DefenUpdate.exe’, suggesting a possible download of an executable (.exe) file. This was corroborated by the total amount of data received in this connection, 4.3 MB. Both the file name and its size suggest that the offending device may have downloaded additional malicious tooling from the SmokeLoader C2 endpoint, such as a trojan or information stealer, as reported on OSINT platforms [4].

Figure 1: Device event log showing the moment when a device made its first connection to a SmokeLoader associated domain, and the use of a new user agent. A few seconds later, the DETECT model “Anomalous Connection / New User Agent to IP Without Hostname” breached.

The observed new user agent, “Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko” was identified as suspicious by Darktrace leading to the “Anomalous Connection / New User Agent to IP Without Hostname” DETECT model breach.

As this specific user agent was associated with the Internet Explorer browser running on Windows 10, it may not have appeared suspicious to traditional security tools. However, Darktrace’s anomaly-based detection allows it to identify and mitigate emerging threats, even those that utilize sophisticated evasion techniques.

This is particularly noteworthy in this case because, as discussed earlier, SmokeLoader is known to inject its malicious code into legitimate processes, like Internet Explorer.

Figure 2: Darktrace detecting the affected device leveraging a new user agent and establishing an anomalous HTTP connection with an external IP, which was 100% rare to the network.

C2 Communication

Darktrace continued to observe the device making repeated connections to the humman[.]art endpoint. Over the next few days. On August 7, the device was observed making unusual POST requests to the endpoint using port 80, breaching the ‘Anomalous Connection / Multiple HTTP POSTs to Rare Hostname’ DETECT model. These observed POST requests were observed over a period of around 10 days and consisted of a pattern of 8 requests, each with a ten-minute interval.

Figure 3: Model Breach Event Log highlighting the Darktrace DETECT model breach ‘Anomalous Connection / Multiple HTTP POSTs to Rare Hostname’.

Upon investigating the details of this activity identified by Darktrace DETECT, a particular pattern was observed in these requests: they used the same user-agent, “Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko”, which was previously detected in the initial breach.

Additionally, they the requests had a constantly changing  eferrer header, possibly using randomly generated domain names for each request. Further examination of the packet capture (PCAP) from these requests revealed that the payload in these POST requests contained an RC4 encrypted string, strongly indicating SmokeLoader C2 activity.

Figure4: Advanced Search results display an unusual pattern in the requests made by the device to the hostname humman[.]art. This pattern shows a constant change in the referrer header for each request, indicating anomalous behavior.
Figure 5: The PCAP shows the payload seen in these POST requests contained an RC4 encrypted string strongly indicating SmokeLoader C2 activity.  

Unfortunately in this case, Darktrace RESPOND was not active on the network meaning that the attack was able to progress through its kill chain. Despite this, the timely alerts and detailed incident insights provided by Darktrace DETECT allowed the customer’s security team to begin their remediation process, implementing blocks on their firewall, thus preventing the SmokeLoader malware from continuing its communication with C2 infrastructure.

Darktrace RESPOND Halting Potential Threats from the Initial Stages of Detection

With Darktrace RESPOND, organizations can move beyond threat detection to proactive defense against emerging threats. RESPOND is designed to halt threats as soon as they are identified by DETECT, preventing them from escalating into full-blown compromises. This is achieved through advanced machine learning and Self-Learning AI that is able to understand  the normal ‘pattern of life’ of customer networks, allowing for swift and accurate threat detection and response.

One pertinent example was seen on July 6, when Darktrace detected a separate SmokeLoader case on a customer network with RESPOND enabled in autonomous response mode. Darktrace DETECT initially identified a string of anomalous activity associated with the download of suspicious executable files, triggering the ‘Anomalous File / Multiple EXE from Rare External Locations’ model to breach.

The device was observed downloading an executable file (‘6523.exe’ and ‘/g.exe’) via HTTP over port 80. These downloads originated from endpoints that had never been seen within the customer’s environment, namely ‘hugersi[.]com’ and ‘45.66.230[.]164’, both of which had strongly been linked to SmokeLoader by OSINT sources, likely indicating the initial infection stage of the attack [5].

Figure 6: This figure illustrates Darktrace DETECT observing a device downloading multiple .exe files from rare endpoints and the associated model breach, ‘Anomalous File / Multiple EXE from Rare External Locations’.

Around the same time, Darktrace also observed the same device downloading an unusual file with a numeric file name. Threat actors often employ this tactic in order to avoid using file name patterns that could easily be recognized and blocked by traditional security measures; by frequently changing file names, malicious executables are more likely to remain undetected.

Figure 7: Graph showing the unusually high number of executable files downloaded by the device during the initial infection stage of the attack. The orange and red circles represent the number of model breaches that the device made during the observed activity related to SmokeLoader infection.
Figure 8: This figure illustrates the moment when Darktrace DETECT identified a suspicious download with a numeric file name.

With Darktrace RESPOND active and enabled in autonomous response mode, the SmokeLoader infection was thwarted in the first instance. RESPOND took swift autonomous action by blocking connections to the suspicious endpoints identified by DETECT, blocking all outgoing traffic, and enforcing a pre-established “pattern of life” on offending devices. By enforcing a patten of life on a device, Darktrace RESPOND ensures that it cannot deviate from its ‘normal’ activity to carry out potentially malicious activity, while allowing the device to continue expected business operations.

Figure 9:  A total of 8 RESPOND actions were applied, including blocking connections to suspicious endpoints and domains associated with SmokeLoader.

In addition to the autonomous mitigative actions taken by RESPOND, this customer also received a Proactive Threat Notification (PTN) informing them of potentially malicious activity on their network. This prompted the Darktrace Security Operations Center (SOC) to investigate and document the incident, allowing the customer’s security team to shift their focus to remediating and removing the threat of SmokeLoader.

Conclusion

Ultimately, Darktrace showcased its ability to detect and contain versatile and evasive strains of loader malware, like SmokeLoader. Despite its adeptness at bypassing conventional security tools by frequently changing its C2 infrastructure, utilizing existing processes to infect malicious code, and obfuscating malicious file and domain names, Darktrace’s anomaly-based approach allowed it to recognize such activity as deviations from expected network behavior, regardless of their apparent legitimacy.

Considering SmokeLoader’s wide array of functions, including C2 communication that could be used to facilitate additional attacks like exfiltration, or even the deployment of information-stealers or ransomware, Darktrace proved to be crucial in safeguarding customer networks. By identifying and mitigating SmokeLoader at the earliest possible stage, Darktrace effectively prevented the compromises from escalating into more damaging and disruptive compromises.

With the threat of loader malware expected to continue growing alongside the boom of the MaaS industry, it is paramount for organizations to adopt proactive security solutions, like Darktrace DETECT+RESPOND, that are able to make intelligent decisions to identify and neutralize sophisticated attacks.

Credit to Patrick Anjos, Senior Cyber Analyst, Justin Torres, Cyber Analyst

Appendices

Darktrace DETECT Model Detections

- Anomalous Connection / New User Agent to IP Without Hostname

- Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

- Anomalous File / Multiple EXE from Rare External Locations

- Anomalous File / Numeric File Download

List of IOCs (IOC / Type / Description + Confidence)

- 85.208.139[.]35 / IP / SmokeLoader C2 Endpoint

- 185.174.137[.]109 / IP / SmokeLoader C2 Endpoint

- 45.66.230[.]164 / IP / SmokeLoader C2 Endpoint

- 91.215.85[.]147 / IP / SmokeLoader C2 Endpoint

- tolilolihul[.]net / Hostname / SmokeLoader C2 Endpoint

- bulimu55t[.]net / Hostname / SmokeLoader C2 Endpoint

- potunulit[.]org / Hostname / SmokeLoader C2 Endpoint

- hugersi[.]com / Hostname / SmokeLoader C2 Endpoint

- human[.]art / Hostname / SmokeLoader C2 Endpoint

- 371b0d5c867c2f33ae270faa14946c77f4b0953 / SHA1 / SmokeLoader Executable

References:

[1] https://bazaar.abuse.ch/sample/d7c395ab2b6ef69210221337ea292e204b0f73fef8840b6e64ab88595eda45b3/#intel

[2] https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

[3] https://www.darkreading.com/cyber-risk/breaking-down-the-propagate-code-injection-attack

[4] https://n1ght-w0lf.github.io/malware%20analysis/smokeloader/

[5] https://therecord.media/surge-in-smokeloader-malware-attacks-targeting-ukrainian-financial-gov-orgs

MITRE ATT&CK Mapping

Model: Anomalous Connection / New User Agent to IP Without Hostname

ID: T1071.001

Sub technique: T1071

Tactic: COMMAND AND CONTROL

Technique Name: Web Protocols

‍

Model: Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

ID: T1185

Sub technique: -

Tactic: COLLECTION

Technique Name: Man in the Browser

‍

ID: T1071.001

Sub technique: T1071

Tactic: COMMAND AND CONTROL

Technique Name: Web Protocols

‍

Model: Anomalous File / Multiple EXE from Rare External Locations

ID: T1189

Sub technique: -

Tactic: INITIAL ACCESS

Technique Name: Drive-by Compromise

‍

ID: T1588.001

Sub technique: - T1588

Tactic: RESOURCE DEVELOPMENT

Technique Name: Malware

‍

Model: Anomalous File / Numeric File Download

ID: T1189

Sub technique: -

Tactic: INITIAL ACCESS

Technique Name: Drive-by Compromise

‍

ID: T1588.001

Sub technique: - T1588

Tactic: RESOURCE DEVELOPMENT

Technique Name: Malware

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Patrick Anjos
Senior Cyber Analyst
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment
Dec 9, 2024
2
Cloud Security: Addressing Common CISO Challenges with Advanced Solutions
Nov 28, 2024
3
Preparing for 2025: Darktrace's Top 10 AI and Cybersecurity Predictions
Nov 3, 2024
4
Navigating Buying and Adoption Journeys for AI Cybersecurity Tools
Oct 15, 2024
5
How Darktrace won an email security trial by learning the business, not the breach
Oct 9, 2024

More in this series

No items found.

Blog

/

December 12, 2024

/
No items found.

Company Shuts Down Cyber-attacks with “Flawless” Detection and Response from Darktrace

Default blog imageDefault blog image

Growing pains: Balancing efficiency with risk  

This organization has recently scaled its operations, and numerous acquisitions have significantly boosted the organization’s capabilities and growth. However, this also creates work and high expectations for the organization’s IT and security teams. Within 12 months of an acquisition, the teams must fully integrate each new business onto the company’s platform. “A huge piece of that integration plan is rolling out our security controls,” said the CISO. “While our goal is to connect those facilities up as quickly as possible to drive efficiency, we also need to implement the proper security controls to protect the enterprise.”

Gap beyond the perimeter  

The organization had established strong security measures to safeguard its perimeter; however, the CISO identified a critical gap in real-time network monitoring. If the perimeter were breached, threats were only discovered after an endpoint was compromised and the issue was manually reported.

As digital transformation progresses, the need to adopt advanced technologies is becoming essential, particularly as organizations begin to open up operational environments to greater connectivity. Many processes still rely on traditional methods, and integrating innovative solutions could drive significant improvements in efficiency and productivity. “We’re committed to adopting cutting-edge technologies,” the CISO explained. “But we understood that without more robust network security controls, opening up our operational environments would expose us to heightened risks, including advanced threats like ransomware.”

Building a layered, proactive security strategy with Darktrace  

To close the gap beyond the perimeter, the company embarked on a free trial with Darktrace. The CISO recalls: “The trials were fantastic. It was obvious that Darktrace was exactly what we needed. The Darktrace team was also very knowledgeable and helpful throughout the process, which was impressive.”  

Today, the organization is using a combination of Darktrace solutions for its layered security approach, including:

Detecting unusual behavior with AI  

Darktrace’s use of machine learning and Self-Learning AI is one of the reasons the company chose Darktrace. Instead of teaching an AI system what an ‘attack’ looks like, training it on large data lakes of thousands of organizations’ data, Darktrace AI learns from the company’s own unique data and user activity to learn and create baseline models of what ‘normal’ looks like for their business.

Darktrace can then detect subtle deviations and unusual activity that signals a possible threat. “That fascinated us because what it really means is this technology doesn’t need to know about every single threat because the threat itself isn’t important, it’s the behavior of the activity that’s important. That capability is unique when it when it comes to threat detection,” said the CISO.

Identifying and mitigating high-impact attack paths

The security team appreciated that with Darktrace they could take a more proactive approach to security by exposing high-risk attack paths through modeling and AI risk assessments. Darktrace / Proactive Exposure Management gives them visibility into vulnerable entry points and assets, identifies active risks, and prioritizes the most important security issues to be addressed.

“Specific users and assets within our business have a higher risk of being targeted by a cyber-attack, for example our executives,” said the CISO. “With Darktrace, we get an adversarial view of our risk. We can see the attack path around those potential targets and proactively take measures to mitigate that vulnerability and prevent an attack.”

Driving up productivity while putting the brakes on cyber-attacks  

The security team collaborated with Darktrace to fine tune the models that really fit their business. With Darktrace now automating most of their threat detection and response efforts, productivity has soared, the security team is now focused on delivering greater value to the business and, most importantly, Darktrace proved it could quickly detect and shut down a major cyber-attack–and do so without impacting business operations.

Fueling team productivity with automation and AI

Prior to using Darktrace, the security team had little visibility into potential risks beyond the perimeter. Today, the team has full control and visibility over the network. “My team is now spending 80-90% of their time doing proactive work because Darktrace is managing the vast majority of our detect and response needs. The team really has faith in the Darktrace system,” said the CISO.  

With less time spent on low-level manual tasks, the security team can now focus on higher priority initiatives. For example, they have expanded their internal vulnerability assessments across the entire group. The team couldn’t focus on this additional audit and vulnerability management work if Darktrace wasn’t taking care of most of their security monitoring. “Darktrace has allowed us to move on to these additional kinds of governance projects that we otherwise would have to hire an army of staff to get through”.

Stopping email threats in their tracks

Using Darktrace / EMAIL, the company has identified and blocked a significant percentage of emails that were making it past their native email filters. “Darktrace is especially good at detecting impersonation emails, and we really appreciate its ability to automatically remove suspicious emails directly from a user’s inbox. It adds an extra level of confidence,” said the CISO.

Self-Learning AI understands anomalies within unique communication patterns to stop known and unknown threats. For example, when an employee sent an email to a brand new domain, Darktrace identified the behavior as unusual and inconsistent with baseline models and blocked the email.

Darktrace passes the biggest test of all

In 2024, the company experienced the value of the security system firsthand when attackers exploited a vulnerability in a third-party remote support solution that they was using. This solution provided remote access and tech support capabilities. If successful, the attackers could have infiltrated high-value end points and created their own administrative user, giving them full control over the server.

“We first became aware of the attack when Darktrace notified us of unusual behavior coming from the remote support server,” said the CISO. The attackers were attempting to put backdoors onto the service with the intent of selling access to the highest bidder who would then install ransomware on their servers. It all happened very quickly, as the attackers tried to connect to the internal network and other servers, while also firing off a host of other actions, like PowerShell commands, to escalate their privileges.  

“Darktrace worked flawlessly. There was no chance that ransomware was ever going to come in,” the CISO said. “Even though there was no signature to really look at, Darktrace realized this was not normal behavior for this server, shutting down connections and doing everything it could do to stop the attack.” Within eight hours, the security team identified and stopped the attack, severed its connection to the third-party solution, and completed additional analysis and clean-up. “In addition to our own investigation, third parties like our external SOC and legal department also confirmed that Darktrace performed as expected. We were able to report back to the executive team that there was zero risk that any data or systems were compromised.”

Post-attack, there was no need to make any changes to Darktrace. The team consistently reviews its models and baselines, often collaborating with Darktrace to make adjustments when needed to continuously improve performance. “Because of this relationship and constant engagement with Darktrace’s technical teams, we didn't have to go back and ask: ‘why wasn’t this updated’ or ‘why didn’t this model work.’ The models worked.”

His advice to other organizations facing similar challenges? First, focus on updating, patching, and vulnerability management, and act quickly when vulnerabilities are identified. His second piece of advice: “have an automated detection system like Darktrace in place so you can respond at the speed that these attacks evolve. Humans can no longer keep up with a scripted attack as it moves around and tries to compromise items on your network. You need the right technology to fight these types of attacks.”

Dynamic capabilities for a dynamic future

Real-time playbooks

With a proactive, enterprise-wide security strategy in place, the CISO now has the time to think about future projects and innovations. He’s particularly interested in the idea of generating playbooks on the fly in response to real-time events. He believes cyber-attacks are far too varied for a static playbook to be useful; when an attack strikes, teams need to quickly understand exactly what’s in front of them and how to shut it down. “This fits into our future cybersecurity strategy, and Darktrace is the only company I’ve seen talking about building playbooks dynamically. This kind of technology would really help bring our cybersecurity strategy full circle.”

“Darktrace ’s technology, experience and expertise is helping us staying ahead of cyber-attacks, minimizing our risk and driving greater productivity for our team,” said the CISO. In collaboration with Darktrace, the team have created a security foundation that is both powerful and agile. “While Darktrace is detecting and responding to attacks targeting our business today, we know that it’s always learning, adapting and scaling to ensure we’re protected tomorrow. That gives me peace of mind and the freedom to focus on our future.”

Download the Darktrace / NETWORK Solution Brief

Darktrace / NETWORK solution brief screenshot

Protect in real time: Defend against known and emerging threats without relying on historical data or external intelligence.

Full visibility: Gain comprehensive insights across all network environments, including on-premises, cloud, and remote devices.

AI-powered efficiency: Streamline incident response with AI automation, saving time and resources while ensuring minimal disruption to operations.

Continue reading
About the author
The Darktrace Community

Blog

/

December 11, 2024

/
No items found.

Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment

Default blog imageDefault blog image

Darktrace is pleased to announce that we have been positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment. We believe this further highlights Darktrace’s position as a pioneer in the NDR market and follows similar recognition from KuppingerCole, who recently named Darktrace as an Overall Leader, Product Leader, Market Leader and Innovation Leader in the KuppingerCole Leadership Compass: Network Detection and Response (2024).

Network Detection and Response (NDR) solutions are uniquely positioned to provide visibility over the core hub of a business and employee activity, analyzing North-South and East-West traffic to identify threats across the modern network. NDR provides a rich and true source of anomalies and goes beyond process level data that is relied on by Endpoint Detection and Response (EDR) agents that do not provide network level visibility and can be misconfigured at any time.1

Metadata from network traffic can be used to detect a variety of different threats based on events such as anomalous port usage, unusual upload/download activity, impossible travel and many other activities. This has been accelerated by the increased usage of user behavioral analytics (UBA) in network security, which establishes statistical baselines about network entities and highlights deviations from expected activity.1

Darktrace is recognized as a Leader in the IDC MarketScape due to our leadership in the market and our pioneering leadership in AI over the past decade, alongside a variety of other unique differentiators and innovations in the NDR industry.

Darktrace / NETWORK™ delivers full visibility, real time threat detection and Autonomous Response capabilities across an organization’s on-premises, cloud, hybrid and virtual environments, including remote worker endpoints.

Unique Approach to AI

Most NDR vendors and network security tools such as IDS/IPS rely on detecting known attacks with historical data and supervised machine learning, leaving organizations blind and vulnerable to novel threats such as zero-days, variants of known attacks, supply chain attacks and insider threats.

These vendors also tend to apply AI models that are trained globally, and are not unique to each organization’s environment, which creates a high number of false positives and alerts that ultimately lack business context.

The IDC MarketScape recognizes that Darktrace takes a differentiated approach in the market with regards to delivering network detection and response capabilities, noting; “Darktrace is unique in that it does not rely on rules and signatures but rather learns what constitutes as normal for an organization and generates alerts when there is a deviation.”1

Darktrace / NETWORK achieves this through the use of Self-Learning AI and unsupervised machine learning to understand what is normal network behavior, continuously analyzing, mapping and modeling every connection to create a full picture of devices, identities, connections and potential attack paths. Darktrace Self-Learning AI autonomously optimizes itself to cut through the noise and quickly surface genuine, prioritized network security incidents – significantly reducing false positives and removing the hassle of needing to continually tuning alerts manually.

Darktrace’s unique approach to AI also extends to the investigation and triage of network alerts with Cyber AI Analyst. Unlike a chat or prompt based LLM, Cyber AI Analyst investigates all relevant alerts in an environment, including third party alerts, autonomously forming hypotheses and reaching conclusions just like a human analyst would, accelerating SOC Level 2 analyses of incidents by 10x. Cyber AI Analyst also typically providing SOC teams with up to 50,000 additional hours annually of Level 2 analysis producing high level alerts and written reporting, transforming security operations.2

Darktrace also uses its deep understanding of what is normal for a network to identify suspicious behavior, leveraging Autonomous Response capabilities to shut down both known and novel threats in real time, taking targeted actions without disrupting business operations. Darktrace / NETWORK is the only NDR solution that can autonomously enforce a pattern of life based on what is normal for a standalone device or group of peers, rapidly containing and disarming threats based on the overall context of the environment and a granular understanding of what is normal for a device or user – instead of relying on historical attack data.

Continued NDR Market Leadership

Darktrace has been recognized as a Leader in the NDR market, and the IDC MarketScape listed a variety of strengths:

  • Darktrace achieves roughly one-fifth of all global NDR revenue. This is important because other IT and cybersecurity solutions providers necessarily want to have integration with Darktrace.
  • The AI algorithms that Darktrace uses for NDR have had 10 years of deployments, tuning, and learning to draw from.
  • Darktrace is available as a SaaS, as an enterprise license, and as physical, hybrid, or virtual appliances. Darktrace also offers an endpoint agent and visibility into VPN and ZTNA.
  • Darktrace integrates with 30+ different interfaces including SIEM, SOAR, XDR platforms, IT ticketing solutions, and their own dashboards. The Darktrace Threat Visualizer highlights events and incidents from the entire deployment including cloud, apps, email, endpoint, zero trust, network, and OT.
  • Darktrace / NETWORK charts the progress that the SOC is making over time with key metrics such as MTTD/MTTR, alerts generated and processed, and other criteria.
  • Darktrace reported coverage of 14 MITRE ATT&CK categories, 158 techniques, and 184 subtechniques

Proactive Network Resilience

The IDC MarketScape notes, “Ultimately, NDR shines as a standalone detection and response technology but is especially powerful when combined with other platforms. NDR in combination with other control points such as endpoint, data, identity, and application provides the proper context when winnowing alerts and trying to uncover a single source of truth.” . Darktrace comprehensively addresses this as part of the ActiveAI Security Platform, by combining network alerts with data from / EMAIL, / IDENTITY, / ENDPOINT, / CLOUD and / OT, providing deeper contextual analysis for each network alert and automatically enriching investigations.

Darktrace also goes beyond NDR solutions with capabilities that are closely linked to our NDR offering, helping clients to achieve and maintain a state of proactive network resilience:

  • ‍Darktrace / Proactive Exposure Management – look beyond just CVE risks to discover, prioritize and validate risks by business impact and how to address them early, reducing the number of real threats that security teams need to handle.‍
  • Darktrace / Incident Readiness & Recovery – lets teams respond in the best way to each incident and proactively test their familiarity and effectiveness of IR workflows with sophisticated incident simulations based on their own analysts and assets.

Together, these solutions allow Darktrace / NETWORK to go beyond the traditional approach to NDR and shift teams to a more hardened and proactive stance.

Protecting Clients with Continued Innovation

Darktrace invests heavily in Research and Development to continue providing customers with market-leading NDR capabilities and innovations, which was reflected in our position in the Leader category of the MarketScape report for both capabilities and strategy. We are led by the needs and challenges of our customers, which serve as the driving force behind our continued innovation and leadership in the NDR market. The IDC MarketScape report underlines this approach with the following feedback presented by Darktrace customers:

“A customer intimated that 99% of their detections were OOTB with little need to tune or define parameters.”
“A customer reported that it had early warnings for adversarial tactics such as suspicious SMB scanning, suspicious remote execution, remote desktop protocol (RDP) scanning, data exfiltration, C2C, LDAP query, and suspicious Kerberos activity.”
“The client could use Regex to determine if suspicious behavior was found elsewhere on the network.”

Thousands of customers around the world across all industries and sectors rely on Darktrace / NETWORK to protect against known and novel threats. From the latest vulnerabilities in network hardware to sophisticated new strains of ransomware and everything in-between, Darktrace helps clients detect and respond to all types of threats affecting their networks and avoid business disruption, even from the latest attacks.

Find out more about the unique capabilities of Darktrace / NETWORK and our application of AI in network security in the IDC MarketScape excerpt.

References

  1. ‍ IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment (Doc #US51752324, November 2024)
  2. Darktrace Cyber AI Analyst Customer Fleet Data
Continue reading
About the author
Mikey Anderson
Product Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI