Blog
/
Network
/
September 6, 2021

What Are the Early Signs of a Ransomware Attack?

Discover the early signs of ransomware and how to defend against it. Often attack is the best form of defense with cybersecurity. Learn more here!
Written by
Brianna Leddy
Director of Analyst Operations
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Brianna Leddy
Director of Analyst Operations
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
06
Sep 2021

The deployment of ransomware is the endgame of a cyber-attack. A threat actor must have accomplished several previous steps – including lateral movement and privilege escalation – to reach this final position. The ability to detect and counter the early moves is therefore just as important as detecting the encryption itself.

Attackers are using diverse strategies – such as ‘Living off the Land’ and carefully crafting their command and control (C2) – to blend in with normal network traffic and evade traditional security defenses. The analysis below examines the Tactics, Techniques and Procedures (TTPs) used by many ransomware actors by unpacking a compromise which occurred at a defense contractor in Canada.

Phases of a ransomware attack

Figure 1: Timeline of the attack.

The opening: Initial access to privileged account

The first indicator of compromise was a login on a server with an unusual credential, followed by unusual admin activity. The attacker may have gained access to the username and password in a number of ways, from credential stuffing to buying them on the Dark Web. As the attacker had privileged access from the get-go, there was no need for privilege escalation.

Lateral movement

Two days later, the attacker began to spread from the initial server. The compromised server began to send out unusual Windows Management Instrumentation (WMI) commands.

It began remotely controlling four other devices – authenticating on them with a single admin credential. One of the destinations was a domain controller (DC), another was a backup server.

By using WMI – a common admin tool – for lateral movement, the attacker opted to ‘live off the land’ rather than introduce a new lateral movement tool, aiming to remain unnoticed by the company’s security stack. The unusual use of WMI was picked up by Darktrace and the timings of the unusual WMI connections were pieced together by Cyber AI Analyst.

Models:

  • New or Uncommon WMI Activity
  • AI Analyst / Extensive Chain of Administrative Connections

Establish C2

The four devices then connected to the IP 185.250.151[.]172. Three of them, including the DC and backup server, established SSL beacons to the IP using the dynamic DNS domain goog1e.ezua[.]com.

The C2 endpoints had very little open-source intelligence (OSINT) available, but it seems that a Cobalt Strike-style script had used the endpoint in the past. This suggests complex tooling, as the attacker used dynamic SSL and spoofed Google to mask their beaconing.

Interestingly, through the entirety of the attack, only these three devices used SSL connections for beaconing, while later C2 occurred over unencrypted protocols. It appears these three critical devices were treated differently to the other infected devices on the network.

Models:

  • Immediate breach of Anomalous External Activity from Critical Network Device, then several model breaches involving beaconing and SSL to dynamic DNS. (Domain Controller DynDNS SSL or HTTP was particularly specific to this activity.)

The middle game: Internal reconnaissance and further lateral movement

The attack chain took the form of two cycles of lateral movement, followed by establishing C2 at the newly controlled destinations.

Figure 2: Observed chain of lateral movement and C2.

So, after establishing C2, the DC made WMI requests to 20 further IPs over an extended period. It also scanned 234 IPs via ICMP pings, presumably in an attempt to find more hosts.

Many of these were eventually found with ransom notes, in particular when the targeted devices were hypervisors. The ransomware was likely deployed with remote commands via WMI.

Models:

  • AI Analyst / Suspicious Chain of Administrative Connections (from the initial server to the DC to the hypervisor)
  • AI Analyst / Extensive Suspicious WMI Activity (from the DC)
  • Device / ICMP Address Scan, Scanning of Multiple Devices AI Analyst incident (from the DC)

Further C2

As the second stage of lateral movement stopped, a second stage of unencrypted C2 was seen from five new devices. Each started with GET requests to the IP seen in the SSL C2 (185.250.151[.]172), which used the spoofed hostname google[.]com.

Activity started on each device with HTTP requests for a URI ending in .png, before a more consistent beaconing to the URI /books/. Eventually, the devices made POST requests to the URI /ebooks/?k= (a unique identifier for each device). All this appears to be a way of concealing a C2 beacon in what looks like plausible traffic to Google.

In this way, by encrypting some C2 connections with SSL to a Dynamic DNS domain, while crafting other unencrypted HTTP to look like traffic to google[.]com, the attacker managed to operate undetected by the company’s antivirus tools.

Darktrace identified this anomalous activity and generated a large number of external connectivity model breaches.

Models:

  • Eight breaches of Compromise / HTTP Beaconing to New Endpoint from the affected devices

Accomplish mission: Checkmate

Finally, the attacker deployed ransomware. In the ransom note, they stated that sensitive information had been exfiltrated and would be leaked if the company did not pay.

However, this was a lie. Darktrace confirmed that no data had been exfiltrated, as the C2 communications had sent far too little data. Lying about data exfiltration in order to extort a ransom is a common tactic for attackers, and visibility is crucial to determine whether a threat actor is bluffing.

In addition, Antigena – Darktrace’s Autonomous Response technology – blocked an internal download from one of the servers compromised in the first round of lateral movement, because it was an unusual incoming data volume for the client device. This was most likely the attacker attempting to transfer data in preparation for the end goal, so the block may have prevented this data from being moved for exfiltration.

Figure 3: Antigena model breach.

Figure 4: Device is blocked from SMB communication with the compromised server three seconds later.

Models:

  • Unusual Incoming Data Volume
  • High Volume Server Data Transfer

Unfortunately, Antigena was not active on the majority of the devices involved in the incident. If in active mode, Antigena would have stopped the early stages of this activity, including the unusual administrative logins and beaconing. The customer is now working to fully configure Antigena, so they benefit from 24/7 Autonomous Response.

Cyber AI Analyst investigates

Darktrace’s AI spotted and reported on beaconing from several devices including the DC, which was the highest scoring device for unusual behavior at the time of the activity. It condensed this information into three incidents – ‘Possible SSL Command and Control’, ‘Extensive Suspicious Remote WMI Activity’, and ‘Scanning of Remote Devices’.

Crucially, Cyber AI Analyst not only summarized the admin activity from the DC but also linked it back to the first device through an unusual chain of administrative connections.

Figure 5: Cyber AI Analyst incident showing a suspicious chain of administrative connections linking the first device in the chain of connections to a hypervisor where a ransom note was found via the compromised DC, saving valuable time in the investigation. It also highlights the credential common to all of the lateral movement connections.

Finding lateral movement chains manually is a laborious process well suited to AI. In this case, it enabled the security team to quickly trace back to the device which was the likely source of the attack and find the common credential in the connections.

Play the game like a machine

To get the full picture of a ransomware attack, it is important to look beyond the final encryption to previous phases of the kill chain. In the attack above, the encryption itself did not generate network traffic, so detecting the intrusion at its early stages was vital.

Despite the attacker ‘Living off the Land’ and using WMI with a compromised admin credential, as well as spoofing the common hostname google[.]com for C2 and applying dynamic DNS for SSL connections, Darktrace was able to identify all the stages of the attack and immediately piece them together into a meaningful security narrative. This would have been almost impossible for a human analyst to achieve without labor-intensive checking of the timings of individual connections.

With ransomware infections becoming faster and more frequent, with the threat of offensive AI looming closer and the Dark Web marketplace thriving, with security teams drowning under false positives and no time left on the clock, AI is now an essential part of any security solution. The board is set, the time is ticking, the stakes are higher than ever. Your move.

Thanks to Darktrace analyst Daniel Gentle for his insights on the above threat find.

IoCs:

IoCComment185.250.151[.]172IP address used for both HTTP and SSL C2goog1e.ezua[.]comDynamic DNS Hostname used for SSL C2

Darktrace model detections:

  • AI Analyst models:
  • Extensive Suspicious WMI Activity
  • Suspicious Chain of Administrative Connections
  • Scanning of Multiple Devices
  • Possible SSL Command and Control
  • Meta model:
  • Device / Large Number of model breaches
  • External connectivity models:
  • Anonymous Server Activity / Domain Controller DynDNS SSL or HTTP
  • Compromise / Suspicious TLS Beaconing to Rare External
  • Compromise / Beaconing Activity To External Rare
  • Compromise / SSL to DynDNS
  • Anomalous Server Activity / External Activity from Critical Network Device
  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Suspicious Beaconing Behaviour
  • Compromise / HTTP Beaconing to New Endpoint
  • Internal activity models:
  • Device / New or Uncommon WMI Activity
  • User / New Admin Credentials on Client
  • Device / ICMP Address Scan
  • Anomalous Connection / Unusual Incoming Data Volume
  • Unusual Activity / High Volume Server Data Transfer

Written by
Brianna Leddy
Director of Analyst Operations
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Brianna Leddy
Director of Analyst Operations

From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack

Network
•
August 14, 2025
Priya Thapa
Cyber Analyst
Watch the NIS2 Webinar
Trending blogs
1
Introducing the AI Maturity Model for Cybersecurity
Jul 16, 2025
2
Darktrace Recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for Network Detection and Response
Jun 2, 2025
3
Evaluating Email Security: How to Select the Best Solution for Your Organization
May 21, 2025
4
2025 Cyber Threat Landscape: Darktrace’s Mid-Year Review
Aug 5, 2025
5
Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability
Jul 2, 2025

More in this series

No items found.
Continue reading
Network
•
August 14, 2025

From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack

This blog outlines a real-world attack where threat actors exploited Fortinet SSL-VPN vulnerabilities to infiltrate a network. It highlights how Darktrace identified threat and took immediate actions to contain it, demonstrating the importance of proactive detection and rapid intervention in minimizing risk and disruption.
Priya Thapa
Cyber Analyst
Read more
Network
•
August 8, 2025

Ivanti Under Siege: Investigating the Ivanti Endpoint Manager Mobile Vulnerabilities (CVE-2025-4427 & CVE-2025-4428)

Darktrace investigates active exploitation of Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. Threat actors can leverage these CVEs for unauthenticated remote code execution, delivering malware like KrustyLoader. This blog explores evolving post-exploitation tactics and emphasizes the need for continuous visibility and machine-speed response across enterprise network environments.
Nahisha Nobregas
SOC Analyst
Read more
Network
•
August 5, 2025

2025 Cyber Threat Landscape: Darktrace’s Mid-Year Review

Explore key cyber threat trends observed across Darktrace’s customer base in the first half of 2025. As threat actors increasingly adopt AI and diversify their techniques and tooling, anomaly-based detection continues to prove vital in defending against evolving attacks.
Emma Foulger
Global Threat Research Operations Lead
Read more

Blog

/

Network

/

August 15, 2025

From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack

Fortinet SSL-VPN AttackDefault blog imageDefault blog image

Threat actors exploiting Fortinet CVEs

Over the years, Fortinet has issued multiple alerts about a wave of sophisticated attacks targeting vulnerabilities in its SSL-VPN infrastructure. Despite the release of patches to address these vulnerabilities, threat actors have continued to exploit a trio of Common Vulnerabilities and Exposures (CVEs) disclosed between 2022 and 2024 to gain unauthorized access to FortiGate devices.

Which vulnerabilities are exploited?

The vulnerabilities—CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762—affect Fortinet’s SSL-VPN services and have been actively exploited by threat actors to establish initial access into target networks.

The vulnerabilities affect core components of FortiOS, allowing attackers to execute remote code on affected systems.

CVE-2022-42475‍

Type: Heap-Based Buffer Overflow in FortiOS SSL-VPN‍

Impact: Remote Code Execution (Actively Exploited)

This earlier vulnerability also targets the SSL-VPN interface and has been actively exploited in the wild. It allows attackers to execute arbitrary code remotely by overflowing a buffer in memory, often used to deploy malware or establish persistent backdoors [6].

CVE-2023-27997

Type: Heap-Based Buffer Overflow in FortiOS and FortiProxy‍

Impact: Remote Code Execution

This flaw exists in the SSL-VPN component of both FortiOS and FortiProxy. By exploiting a buffer overflow in the heap memory, attackers can execute malicious code remotely. This vulnerability is particularly dangerous because it can be triggered without authentication, making it ideal for an initial compromise [5].

CVE-2024-21762

Type: Out-of-Bounds Write in sslvpnd

Impact: Remote Code Execution

This vulnerability affects the SSL-VPN daemon (sslvpnd) in FortiOS. It allows unauthenticated remote attackers to send specially crafted HTTP requests that write data outside of allocated memory bounds. This can lead to arbitrary code execution, giving attackers full control over a device [4].

In short, these flaws enable remote attackers to execute arbitrary code without authentication by exploiting memory corruption issues such as buffer overflows and out-of-bounds writes. Once inside, threat actors use symbolic link (symlink) in order to maintain persistence on target devices across patches and firmware updates. This persistence then enables them to bypass security controls and manipulate firewall configurations, effectively turning patched systems into long-term footholds for deeper network compromise [1][2][3].

Darktrace’s Coverage

Darktrace detected a series of suspicious activities originating from a compromised Fortinet VPN device, including anomalous HTTP traffic, internal network scanning, and SMB reconnaissance, all indicative of post-exploitation behavior. Following initial detection by Darktrace’s real-time models, its Autonomous Response capability swiftly acted on the malicious activity, blocking suspicious connections and containing the threat before further compromise could occur.

Further investigation by Darktrace’s Threat Research team uncovered a stealthy and persistent attack that leveraged known Fortinet SSL-VPN vulnerabilities to facilitate lateral movement and privilege escalation within the network.

Phase 1: Initial Compromise – Fortinet VPN Exploitation

The attack on a Darktrace customer likely began on April 11 with the exploitation of a Fortinet VPN device running an outdated version of FortiOS. Darktrace observed a high volume of HTTP traffic originating from this device, specifically targeting internal systems. Notably, many of these requests were directed at the /cgi-bin/ directory,  a common target for attackers attempting to exploit web interfaces to run unauthorized scripts or commands. This pattern strongly indicated remote code execution attempts via the SSL-VPN interface [7].

Once access was gained, the threat actor likely modified existing firewall rules, a tactic often used to disable security controls or create hidden backdoors for future access. While Darktrace does not have direct visibility into firewall configuration changes, the surrounding activity and post-exploitation behavior indicated that such modifications were made to support long-term persistence within the network.

HTTP activity from the compromised Fortinet device, including repeated requests to /cgi-bin/ over port 8080.
Figure 1: HTTP activity from the compromised Fortinet device, including repeated requests to /cgi-bin/ over port 8080

Phase 2: Establishing Persistence & Lateral Movement

Shortly after the initial compromise of the Fortinet VPN device, the threat actor began to expand their foothold within the internal network. Darktrace detected initial signs of network scanning from this device, including the use of Nmap to probe the internal environment, likely in an attempt to identify accessible services and vulnerable systems.

Darktrace’s detection of unusual network scanning activities on the affected device.
Figure 2: Darktrace’s detection of unusual network scanning activities on the affected device.

Around the same time, Darktrace began detecting anomalous activity on a second device, specifically an internal firewall interface device. This suggested that the attacker had established a secondary foothold and was leveraging it to conduct deeper reconnaissance and move laterally through the network.

In an effort to maintain persistence within the network, the attackers likely deployed symbolic links in the SSL-VPN language file directory on the Fortinet device. While Darktrace did not directly observe symbolic link abuse, Fortinet has identified this as a known persistence technique in similar attacks [2][3]. Based on the observed post-exploitation behavior and likely firewall modifications, it is plausible that such methods were used here.

Phase 3: Internal Reconnaissance & Credential Abuse

With lateral movement initiated from the internal firewall interface device, the threat actor proceeded to escalate their efforts to map the internal network and identify opportunities for privilege escalation.

Darktrace observed a successful NTLM authentication from the internal firewall interface to the domain controller over the outdated protocol SMBv1, using the account ‘anonymous’. This was immediately followed by a failed NTLM session connection using the hostname ‘nmap’, further indicating the use of Nmap for enumeration and brute-force attempts. Additional credential probes were also identified around the same time, including attempts using the credential ‘guest’.

Darktrace detection of a series of login attempts using various credentials, with a mix of successful and unsuccessful attempts.
Figure 3: Darktrace detection of a series of login attempts using various credentials, with a mix of successful and unsuccessful attempts.

The attacker then initiated DCE_RPC service enumeration, with over 300 requests to the Endpoint Mapper endpoint on the domain controller. This technique is commonly used to discover available services and their bindings, often as a precursor to privilege escalation or remote service manipulation.

Over the next few minutes, Darktrace detected more than 1,700 outbound connections from the internal firewall interface device to one of the customer’s subnets. These targeted common services such as FTP (port 21), SSH (22), Telnet (23), HTTP (80), and HTTPS (443). The threat actor also probed administrative and directory services, including ports 135, 137, 389, and 445, as well as remote access via RDP on port 3389.

Further signs of privilege escalation attempts were observed with the detection of over 300 Netlogon requests to the domain controller. Just over half of these connections were successful, indicating possible brute-force authentication attempts, credential testing, or the use of default or harvested credentials.

Netlogon and DCE-RPC activity from the affected device, showing repeated service bindings to epmapper and Netlogon, followed by successful and failed NetrServerAuthenticate3 attempts.
Figure 4: Netlogon and DCE-RPC activity from the affected device, showing repeated service bindings to epmapper and Netlogon, followed by successful and failed NetrServerAuthenticate3 attempts.

Phase 4: Privilege Escalation & Remote Access

A few minutes later, the attacker initiated an RDP session from the internal firewall interface device to an internal server. The session lasted over three hours, during which more than 1.5MB of data was uploaded and over 5MB was downloaded.

Notably, no RDP cookie was observed during this session, suggesting manual access, tool-less exploitation, or a deliberate attempt to evade detection. While RDP cookie entries were present on other occasions, none were linked to this specific session—reinforcing the likelihood of stealthy remote access.

Additionally, multiple entries during and after this session show SSL certificate validation failures on port 3389, indicating that the RDP connection may have been established using self-signed or invalid certificates, a common tactic in unauthorized or suspicious remote access scenarios.

Darktrace’s detection of an RDP session from the firewall interface device to the server, lasting over 3 hours.
Figure 5: Darktrace’s detection of an RDP session from the firewall interface device to the server, lasting over 3 hours.

Darktrace Autonomous Response

Throughout the course of this attack, Darktrace’s Autonomous Response capability was active on the customer’s network. This enabled Darktrace to autonomously intervene by blocking specific connections and ports associated with the suspicious activity, while also enforcing a pre-established “pattern of life” on affected devices to ensure they were able to continue their expected business activities while preventing any deviations from it. These actions were crucial in containing the threat and prevent further lateral movement from the compromised device.

Darktrace’s Autonomous Response targeted specific connections and restricted affected devices to their expected patterns of life.
Figure 6: Darktrace’s Autonomous Response targeted specific connections and restricted affected devices to their expected patterns of life.

Conclusion

This incident highlights the importance of important staying on top of patching and closely monitoring VPN infrastructure, especially for internet-facing systems like Fortinet devices. Despite available patches, attackers were still able to exploit known vulnerabilities to gain access, move laterally and maintain persistence within the customer’s network.

Attackers here demonstrated a high level of stealth and persistence. Not only did they gain access to the network and carry out network scans and lateral movement, but they also used techniques such as symbolic link abuse, credential probing, and RDP sessions without cookies to avoid detection.  Darktrace’s detection of the post-exploitation activity, combined with the swift action of its Autonomous Response technology, successfully blocked malicious connections and contained the attack before it could escalate

Credit to Priya Thapa (Cyber Analyst), Vivek Rajan (Cyber Analyst), and Ryan Traill (Analyst Content Lead)

Appendices

Real-time Detection Model Alerts

·      Device / Suspicious SMB Scanning Activity

·      Device / Anomalous Nmap Activity

·      Device / Network Scan

·      Device / RDP Scan

·      Device / ICMP Address Scan

Autonomous Response Model Alerts:  

·      Antigena / Network / Insider Threat / Antigena Network Scan Block

·       Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

MITRE ATT&CK Mapping

Initial Access – External Remote Services – T1133

Initial Access – Valid Accounts – T1078

Execution – Exploitation for Client Execution – T1203

Persistence – Account Manipulation – T1098

Persistence – Application Layer Protocol – T1071.001

Privilege Escalation – Exploitation for Privilege Escalation – T1068

Privilege Escalation – Valid Accounts – T1078

Defense Evasion – Masquerading – T1036

Credential Access – Brute Force – T1110

Discovery – Network Service Scanning – T1046

Discovery – Remote System Discovery – T1018

Lateral Movement – Remote Services – T1021

Lateral Movement – Software Deployment Tools – T1072

Collection – Data from Local System – T1005

Collection – Data Staging – T1074

Exfiltration – Exfiltration Over Alternative Protocol – T1048

References

[1]  https://www.tenable.com/blog/cve-2024-21762-critical-fortinet-fortios-out-of-bound-write-ssl-vpn-vulnerability

[2] https://thehackernews.com/2025/04/fortinet-warns-attackers-retain.html

[3] https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities

[4] https://www.fortiguard.com/psirt/FG-IR-24-015

[5] https://www.tenable.com/blog/cve-2023-27997-heap-based-buffer-overflow-in-fortinet-fortios-and-fortiproxy-ssl-vpn-xortigate

[6]  https://www.tenable.com/blog/cve-2022-42475-fortinet-patches-zero-day-in-fortios-ssl-vpns

[7] https://www.fortiguard.com/encyclopedia/ips/12475

The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.

Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.

Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.

The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.

Continue reading
About the author
Priya Thapa
Cyber Analyst

Blog

/

Cloud

/

August 15, 2025

How Organizations are Addressing Cloud Investigation and Response

Cloud investigation and responseDefault blog imageDefault blog image

Why cloud investigation and response needs to evolve

As organizations accelerate their move to the cloud, they’re confronting two interrelated pressures: a rapidly expanding attack surface and rising regulatory scrutiny. The dual pressure is forcing security practitioners to evolve their strategies in the cloud, particularly around investigation and response, where we see analysts spending the most time. This work is especially difficult in the cloud, often requiring experienced analysts to manually stitch together evidence across fragmented systems, unfamiliar platforms, and short-lived assets.

However, adapting isn’t easy. Many teams are operating with limited budgets and face a shortage of cloud-specific security talent. That’s why more organizations are now prioritizing tools that not only deliver deep visibility and rapid response in the cloud, but also help upskill their analysts to keep pace with threats and compliance demands.

Our 2024 survey report highlights just how organizations are recognizing gaps in their cloud security, feeling the heat from regulators, and making significant investments to bolster their cloud investigation capabilities.

In this blog post, we’ll explore the current challenges, approaches, and strategies organizations are employing to enhance their cloud investigation and incident response.

Recognizing the gaps in current cloud investigation and response methods

Complex environments & static tools

Due to the dynamic nature of cloud infrastructure, ephemeral assets, autoscaling environments, and multi-cloud complexity, traditional investigation and response methods which rely on static snapshots and point-in-time data, are fundamentally mismatched. And with Cloud environment APIs needing deep provider knowledge and scripting skills to extract much needed evidence its unrealistic for one person to master all aspects of cloud incident response.

Analysts are still stitching together logs from fragmented systems, manually correlating events, and relying on post-incident forensics that often arrive too late to drive meaningful response. These approaches were built for environments that rarely changed. In the cloud, where assets may only exist for minutes and attacker movement can span regions or accounts in seconds, point-in-time visibility simply can’t keep up. As a result, critical evidence is missed, timelines are incomplete, and investigations drag on longer than they should.

Even some modern approaches still depend heavily on static configurations, delayed snapshots, or siloed visibility that can’t keep pace with real-time attacker movement.

There is even the problem of  identifying what cloud data sources hold the valuable information needed to investigate in the first place. With AWS alone having over 200 products, each with its own security practices and data sources.It can be challenging to identify where you need to be looking.  

To truly secure the cloud, investigation and response must be continuous, automated, and context-rich. Tools should be able to surface the signal from the noise and support analysts at every step, even without deep forensics expertise.

Increasing compliance pressure

With the rise of data privacy regulations and incident reporting mandates worldwide, organizations face heightened scrutiny. Noncompliance can lead to severe penalties, making it crucial to have robust cloud investigation and response mechanisms in place. 74% of organizations surveyed reported that data privacy regulations complicate incident response, underscoring the urgency to adapt to regulatory requirements.

In addition, a majority of organizations surveyed (89%) acknowledged that they suffer damage before they can fully contain and investigate incidents, particularly in cloud environments, highlighting the need for enhanced cloud capabilities.  

Enhancing cloud investigation and response

To address these challenges, organizations are actively growing their capabilities to perform investigations in the cloud. Key steps include:

Allocating and increasing budgets:  

Recognizing the importance of cloud-specific investigation tools, many organizations have started to allocate dedicated budgets for cloud forensics. 83% of organizations have budgeted for cloud forensics, with 77% expecting this budget to increase. This reflects a strong commitment to improving cloud security.

Implementing automation that understands cloud behavior

Automation isn’t just about speeding up tasks. While modern threats require speed and efficiency from defenders, automation aims to achieve this by enabling consistent decision making across unique and dynamic environments. Traditional SOAR platforms, often designed for static on-prem environments, struggle to keep pace with the dynamic and ephemeral nature of the cloud, where resources can disappear before a human analyst even has a chance to look at them. Cloud-native automation, designed to act on transient infrastructure and integrate seamlessly with cloud APIs, is rapidly emerging as the more effective approach for real-time investigation and response. Automation can cover collection, processing, and storage of incident evidence without ever needing to wait for human intervention and the evidence is ready and waiting all in once place, regardless of if the evidence is cloud-provider logs, disk images, or  memory dumps. With the right automation tools you can even go further and automate the full process from end to end covering acquisition, processing, analysis, and response.

Artificial Intelligence (AI) that augments analysts’ intuition not just adds speed

While many vendors tout AI’s ability to “analyze large volumes of data,” that’s table stakes. The real differentiator is how AI understands the narrative of an incident, surfacing high-fidelity alerts, correlating attacker movement across cloud and hybrid environments, and presenting findings in a way that upskills rather than overwhelms analysts.  

In this space, AI isn’t just accelerating investigations, it’s democratizing them by reducing the reliance on highly specialized forensic expertise.  

Strategies for effective cloud investigation and response

Organizations are also exploring various strategies to optimize their cloud investigation and response capabilities:

Enhancing visibility and control:

  • Unified platforms: Implementing platforms that provide a unified view across multiple cloud environments can help organizations achieve better visibility and control. This consolidation reduces the complexity of managing disparate tools and data sources.
  • Improved integration: Ensuring that all security tools and platforms are seamlessly integrated is critical. This integration facilitates better data sharing and cohesive incident management.
  • Cloud specific expertise: Training and Recruitment: Investing in training programs to develop cloud-specific skills among existing staff and recruiting experts with cloud security knowledge can bridge the skill gap.
  • Continuous learning: Given the constantly evolving nature of cloud threats, continuous learning and adaptation are essential for maintaining effective security measures.

Leveraging automation and AI:

  • Automation solutions: Automation solutions for cloud environments can significantly speed up and simplify incident response efficiency. These solutions can handle repetitive tasks, allowing security teams to focus on more complex issues.
  • AI powered analysis: AI can assist in rapidly analyzing incident data, identifying anomalies, and predicting potential threats. This proactive approach can help prevent incidents before they escalate.

Cloud investigation and response with Darktrace

Darktrace’s  forensic acquisition & investigation capabilities helps organizations address the complexities of cloud investigations and incident response with ease. The product seamlessly integrates with AWS, GCP, and Azure, consolidating data from multiple cloud environments into one unified platform. This integration enhances visibility and control, making it easier to manage and respond to incidents across diverse cloud infrastructures.

By leveraging machine learning and automation, Forensic Acquisition & Investigation accelerates the investigation process by quickly analyzing vast amounts of data, identifying patterns, and providing actionable insights. Automation reduces manual effort and response times, allowing your security team to focus on the most pressing issues.

Forensic Acquisition & Investigation can help you stay ahead of threats whilst also meeting regulatory requirements, helping you to maintain a robust cloud security position.

Continue reading
About the author
Calum Hall
Technical Content Researcher
Your data. Our AI.
Elevate your network security with Darktrace AI