How to Stop Cyberattacks Within Minutes on a Budget

TL;DR

Fast attack containment depends on skilled analysts, detailed endpoint telemetry, behavior-based detection, clear response authority, and visibility across the environment. Organizations should define normal activity, enrich searches with threat intelligence and logs, monitor devices that cannot host endpoint tools through the network, and establish rules that permit rapid host isolation before attackers move laterally or reach critical assets.

Transcript

Um, what I'd like to talk about is, you know, catching attacks as quickly as you can. Um, depending on what surveys you read, the average attack, you know, latency between the attack, the time the attack actually occurs, and it's actually detected is roughly two hundred days. Some of those attacks are never detected. Um, how do we get that number d... Read More

Key Insights

• Behavior-based detection is more robust than relying only on indicators of compromise because malware mutates and indicators change. Monitoring actions such as persistence attempts, privilege elevation, suspicious process relationships, and lateral movement can reveal an attack even when its specific technical identifiers are unfamiliar.
• People are the most important component of rapid attack detection. Effective analysts think in systems, form and test hypotheses in near real time, and relentlessly investigate until they understand what happened. These qualities do not necessarily require a computer science or other STEM degree.
• Endpoint telemetry is far more detailed than conventional antivirus data. Useful evidence includes which process launched another process, which libraries were loaded and from where, whether one process accessed another process's memory, and which commands or scripts were executed on the endpoint.
• PowerShell activity is meaningful when evaluated against normal behavior. Examples requiring attention include PowerShell creating a web client or running Base64-encoded scripts, especially when such actions are unexpected in the organization's environment and appear alongside other suspicious endpoint events.
• Threat intelligence is an input for focused searches across detailed telemetry. Information about activity targeting a company or sector, intelligence services, dark-web findings, or notifications from government agencies can help defenders create searches for relevant behaviors and possible threats.
• Normal activity is specific to each environment, so detection searches must be adapted rather than applied blindly. EY used roughly four hundred searches covering behaviors such as unexpected persistence, unusual command-shell activity, and suspicious WMI use, but the searches that work depend on the monitored organization.
• Network monitoring is necessary for endpoints that cannot host telemetry software, including locked-down systems, life-critical equipment, and many IoT devices. Monitoring IP traffic and actual protocols can expose suspicious JavaScript or, when traffic is unencrypted, an executable moving across the network.
• Predefined rules of engagement enable faster containment by establishing whether responders may automatically isolate a host and then notify the client. In the red-team example, this authority allowed defenders to isolate endpoints before the testers could make a lateral move through the environment.

Questions & Answers

Q: How can an organization detect cyberattacks within minutes?

An organization can pursue faster detection by combining skilled analysts, detailed endpoint telemetry, network monitoring, logs, threat intelligence, and visibility across the full environment. Analysts need searches tailored to normal organizational activity and authority to respond quickly. When suspicious persistence, privilege elevation, process behavior, or lateral movement appears, responders can investigate, isolate affected hosts, notify stakeholders, and prevent the attack from reaching critical assets.

Q: Why is behavior-based detection better than relying only on indicators of compromise?

Behavior-based detection is more robust because indicators of compromise change and malware mutates. An unfamiliar malicious application may still reveal itself through recognizable actions, including establishing persistence, elevating privileges, using unexpected command shells, accessing another process's memory, or moving laterally. In the red-team example, defenders detected the application through both an existing VirusTotal signal and its behavior, then stopped it before lateral movement.

Q: What endpoint telemetry helps analysts identify an attack?

Useful endpoint telemetry includes the processes running on a machine, which process launched each process, the libraries loaded, and where those libraries originated. Analysts should also examine inter-process communication, including attempts by one process to access another process's memory, plus complete command-line activity. Suspicious PowerShell behavior, such as creating a web client or using Base64-encoded scripts, can also indicate unexpected attacker activity.

Q: How should security teams monitor devices that cannot run endpoint detection tools?

Devices that cannot accept endpoint telemetry should be observed through network monitoring. This category may include locked-down systems, life-critical equipment, devices outside the security team's control, and many IoT devices. A network monitor can examine IP addresses and the protocols being used. It may detect suspicious JavaScript or, when communications are unencrypted, identify an executable crossing the network and provide an early warning.

Q: What skills should a cyberattack detection analyst have?

A strong detection analyst should be a systems thinker who can create a hypothesis in near real time, test it against available evidence, and continue investigating until the event is understood. Persistence and the ability to see the broader picture are crucial. These characteristics do not always accompany a computer science or STEM degree, so organizations should consider candidates from a wider range of educational backgrounds.

Q: How do rules of engagement improve incident response speed?

Rules of engagement define what responders may do when they detect suspicious activity. In one client engagement, the agreed procedure allowed the monitoring team to isolate an endpoint automatically and notify the client afterward. That authority removed delays during a red-team exercise and prevented the testers from moving laterally. Clear response permissions therefore connect detection technology with timely containment actions.

Q: How was a real remote-office cyberattack contained?

The real attack began in a remote office on another continent. The attacker established persistence, elevated privileges, conducted reconnaissance, moved between machines and networks, gathered data, and prepared it for exfiltration. When the activity reached the core US corporate network and approached critical assets, responders isolated infected hosts through the endpoint tool, blocked command-and-control IP addresses at the firewall, and reimaged roughly twenty machines.

Q: How can limited security budgets be used more effectively?

A limited budget can be focused on early visibility and containment because remediating a few compromised machines is cheaper than rebuilding domain controllers and repairing business processes after a widespread breach. The required capabilities include capable people, detailed endpoint telemetry, network monitoring for unsupported devices, relevant logs, threat intelligence, and integrated visibility. Searches should be selected according to the organization's environment and its definition of normal activity.

Summary & Key Takeaways

• Organizations can reduce the time between an attack and its detection by combining capable analysts with endpoint telemetry, network monitoring, logs, threat intelligence, and integrated visibility. Early detection lowers remediation costs because responders may need to reimage only a small group of machines instead of rebuilding domain controllers and repairing disrupted business processes.

• A red-team exercise demonstrated how behavior-based detection and predefined response authority can stop an intrusion before lateral movement. Analysts identified an unexpected application attempting persistence and privilege elevation, then isolated affected endpoints. The controls were so effective that the client asked the monitoring team to stand down so the broader test could continue.

• During a real intrusion originating from a remote office, analysts watched an attacker establish persistence, elevate privileges, conduct reconnaissance, move between networks, gather data, and prepare it for exfiltration. When the attacker approached the core corporate network, responders isolated infected hosts, blocked command-and-control IP addresses, and reimaged roughly twenty machines.