news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

Form analysis
4 forms found in the DOM

GET https://news.sophos.com/en-us/

<form role="search" method="get" action="https://news.sophos.com/en-us/">
  <input type="text" class="block w-full text-lg text-white placeholder-gray-100 bg-blue-800 border-0 rounded-md font-sansMedium font-medium" placeholder="Type to Search News" x-ref="searchInput" name="s">
  <div class="absolute inset-y-0 right-0 flex items-center px-3">
    <button class="hover:opacity-100 opacity-60 p-1 text-xs text-white uppercase rounded-full cursor-pointer" type="submit"> Search </button>
  </div>
</form>

GET https://news.sophos.com/en-us/

<form role="search" method="get" action="https://news.sophos.com/en-us/">
  <input type="text" class="focus:ring-blue-600 focus:border-blue-600 sm:text-sm block w-full placeholder-gray-600 border-gray-300 rounded-md" placeholder="Search News" name="s">
  <div class="absolute inset-y-0 right-0 flex items-center px-3 pointer-events-none">
    <button class="p-1 text-gray-500 rounded-full" type="submit">
      <span class="sr-only">Search</span>
      <!-- Heroicon name: outline/bell -->
      <svg class="w-4 h-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor">
        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"></path>
      </svg>
    </button>
  </div>
</form>

POST https://news.sophos.com/wp-comments-post.php

<form action="https://news.sophos.com/wp-comments-post.php" method="post" id="commentform" class="comment-form" novalidate="">
  <p class="comment-notes"><span id="email-notes">Your email address will not be published.</span> <span class="required-field-message" aria-hidden="true">Required fields are marked <span class="required" aria-hidden="true">*</span></span></p>
  <p class="comment-form-comment"><label for="comment">Comment <span class="required" aria-hidden="true">*</span></label> <textarea id="comment" name="comment" cols="45" rows="8" maxlength="65525" required=""></textarea></p>
  <p class="comment-form-author"><label for="author">Name</label> <input id="author" name="author" type="text" value="" size="30" maxlength="245"></p>
  <p class="comment-form-email"><label for="email">Email</label> <input id="email" name="email" type="email" value="" size="30" maxlength="100" aria-describedby="email-notes"></p>
  <p class="comment-form-url"><label for="url">Website</label> <input id="url" name="url" type="url" value="" size="30" maxlength="200"></p>
  <p class="comment-form-cookies-consent"><input id="wp-comment-cookies-consent" name="wp-comment-cookies-consent" type="checkbox" value="yes"> <label for="wp-comment-cookies-consent">Save my name, email, and website in this browser for the next time
      I comment.</label></p>
  <input type="hidden" name="redirect_to" value="https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/" id="redirect_to">
  <p class="form-submit"><input name="submit" type="submit" id="submit" class="submit" value="Post Comment"> <input type="hidden" name="comment_post_ID" value="84392" id="comment_post_ID">
    <input type="hidden" name="comment_parent" id="comment_parent" value="0">
  </p>
  <p style="display: none;"><input type="hidden" id="akismet_comment_nonce" name="akismet_comment_nonce" value="e2d9174eb0"></p>
  <p style="display: none !important;"><label>Δ<textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100"></textarea></label><input type="hidden" id="ak_js_1" name="ak_js" value="1655314922163">
    <script>
      document.getElementById("ak_js_1").setAttribute("value", (new Date()).getTime());
    </script>
  </p>
</form>

<form action="">
  <div class="flex flex-col my-6">
    <input type="text" placeholder="name@email.com" class="w-full" x-model="email" x-on:keydown="resetErrors()" required="">
    <div x-show="message" x-text="message" class="font-sansMedium px-4 py-3 mt-2 text-sm font-medium text-white bg-black border rounded-md" style="display: none;"></div>
  </div>
  <div class="mb-4 text-lg"> Which categories are you interested in? </div>
  <div class="my-2 space-y-1">
    <template x-for="category in Object.entries(categories)" :key="category[0]">
      <div>
        <label x-bind:for="category[1].value" class="inline-flex items-center">
          <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo">
          <span class="text-style-form-label ml-2" x-text="category[1].name">
          </span>
        </label>
      </div>
    </template>
    <div>
      <label x-bind:for="category[1].value" class="inline-flex items-center" for="products-services">
        <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo" value="products-services" id="products-services" name="products-services">
        <span class="text-style-form-label ml-2" x-text="category[1].name">Products and Services</span>
      </label>
    </div>
    <div>
      <label x-bind:for="category[1].value" class="inline-flex items-center" for="threat-research">
        <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo" value="threat-research" id="threat-research" name="threat-research">
        <span class="text-style-form-label ml-2" x-text="category[1].name">Threat Research</span>
      </label>
    </div>
    <div>
      <label x-bind:for="category[1].value" class="inline-flex items-center" for="security-operations">
        <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo" value="security-operations" id="security-operations" name="security-operations">
        <span class="text-style-form-label ml-2" x-text="category[1].name">Security Operations</span>
      </label>
    </div>
    <div>
      <label x-bind:for="category[1].value" class="inline-flex items-center" for="ai-research">
        <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo" value="ai-research" id="ai-research" name="ai-research">
        <span class="text-style-form-label ml-2" x-text="category[1].name">AI Research</span>
      </label>
    </div>
    <div>
      <label x-bind:for="category[1].value" class="inline-flex items-center" for="sophos-life">
        <input type="checkbox" x-bind:value="category[1].value" x-bind:id="category[1].value" x-bind:name="category[1].value" x-model="subscribeTo" value="sophos-life" id="sophos-life" name="sophos-life">
        <span class="text-style-form-label ml-2" x-text="category[1].name">#SophosLife</span>
      </label>
    </div>
  </div>
  <div class="mt-6">
    <input type="submit" class="round-button round-button--primary opacity-30 cursor-not-allowed" @click.prevent="submit()" x-bind:value="buttonText()" x-bind:class="{ 'opacity-30 cursor-not-allowed': buttonDisabled() }"
      x-bind:disabled="buttonDisabled()" value="Subscribe" disabled="disabled">
  </div>
</form>

Text Content

Skip to content
Search
 * Products & Services
   
 * Security Operations
   
 * Threat Research
   
 * AI Research
   
 * Security News
   
 * Sophos Life
   

Search
Open main menu
Search
 * Products & Services
   
 * Security Operations
   
 * Threat Research
   
 * AI Research
   
 * Security News
   
 * Sophos Life
   

SOPHOS SecOps


THE ACTIVE ADVERSARY PLAYBOOK 2022

Cyberattacker behaviors, tactics and tools seen on the frontline of incident
response during 2021
Written by John Shier
June 07, 2022
Security Operations active adversary Artifacts Attack Tools cobalt strike
Cryptomining cyberattacks cyberthreats dwell time Exploit featured initial
access broker malware delivery system MITRE ProxyLogon ProxyShell Ransomware
ransomware as a service Sophos Rapid Response vulnerability


INTRODUCTION

The challenge of defending an organization against rapidly evolving,
increasingly complex cyberthreats can be considerable. Adversaries continuously
adapt and evolve their behavior and toolsets, leverage new vulnerabilities, and
misuse everyday IT tools to evade detection and stay one step ahead of security
teams.

It can be hard for an organization’s IT and security operations professionals to
keep up with the latest approaches used by adversaries. This is true
particularly when it comes to targeted, active attacks that involve more than
one perpetrator, such as an initial access broker (IAB) breaching a target and
then selling that access on to a ransomware gang for use in their attack.

The Active Adversary Playbook 2022 details the main adversaries, tools, and
attack behaviors seen in the wild during 2021 by Sophos’ frontline incident
responders. It follows on from the Active Adversary Playbook 2021 and shows how
the attack landscape continues to evolve.

The aim is to help security teams understand what adversaries do during attacks
and how to spot and defend against such activity on their network.

The findings are based on data from incidents investigated by the Sophos Rapid
Response team during 2021. Where possible, the data is compared against the
incident response findings outlined in the Active Adversary Playbook 2021.


INCIDENT RESPONSE DEMOGRAPHICS 2021

The report is based on 144 incidents targeting organizations of all sizes, in a
wide range of industry sectors, and located in the U.S., Canada, the U.K.,
Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the
United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and
Japan.

The most represented sectors are manufacturing (17% of incident response cases
were in this sector) followed by retail (14%), healthcare (13%), IT (9%),
construction (8%), and education (6%). Additional profile information can be
found in the data tables at the end of this report.


DASHBOARD: THE ANATOMY OF ACTIVE ATTACKS IN 2021

Two of the most influential cyberthreat developments of the year occurred in
March and August 2021, with the reporting of the ProxyLogon and ProxyShell
vulnerabilities in Microsoft Exchange servers. As noted recently by CISA and
other government security agencies, the ProxyLogon/ProxyShell bugs have been
extensively exploited by adversaries. Not surprisingly, they feature in a
significant number of the incidents investigated by Sophos during 2021.

There are likely to be many more ProxyLogon/ProxyShell breaches that are
currently unknown, where web shells and backdoors have been implanted in victims
for persistent access and are now waiting silently until that access is used or
sold.

This leads to another major development shaping the cyberthreat landscape in
2021: the growing influence and power of initial access brokers (IABs).

The success of IABs depends on being the first to breach a target and achieve
access they can sell on. As a result, IABs are often quick to appear on the
scene of newly reported bugs, hoping to compromise targets before widespread
patching has taken place. Their aim is to secure a foothold in a victim and
possibly do some initial exploratory movement to get a sense of the value of the
asset – before selling it on to other adversaries, such as ransomware operators,
to use in attacks, sometimes months after the initial intrusion.

As highlighted in the Sophos 2022 Threat Report, the rise of IABs reflects the
growing “professionalization” of attacks in a cyberthreat market that features a
growing number of specialized service suppliers. The thriving ransomware as a
service (RaaS) industry is another example of this trend.

Last but not least, forensic evidence uncovered during incident response
investigations in 2021 revealed instances where multiple adversaries, including
IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware
operators, were targeting the same organization simultaneously. This is a
development that will continue to shape the cyberthreat landscape in 2022 and
beyond.

The length of time intruders spend in victim networks is increasing, likely due
to such activity. Other adversaries that are in victim networks for the long
haul, sometimes concurrently, include botnet builders and malware delivery
platforms or droppers.

These developments are discussed in more detail below.


THE INVISIBLE INTRUDERS

The incident data shows that the median average dwell time increased by about a
third between 2020 and 2021, from 11 days to 15. There was considerable
variation, with attacks that culminated in ransomware having shorter dwell
times, on average around 11 days (down from 18 in 2020), and those involving
other intrusions lasting significantly longer, with a median dwell time of 34
days.



As suggested above, longer dwell times may reflect the involvement of an IAB.
For smaller businesses or industry sectors such as education (average intruder
dwell time 34 days), the longer dwell times also reflect how hard it can be for
in-house IT security staff to proactively hunt for, investigate, and respond to
suspicious alerts and potential threats.




THE ROOT CAUSES OF ATTACKS

It is not always possible, or easy, to identify the root cause of an attack.
Sometimes the attackers have intentionally deleted evidence of their activity
and sometimes the IT security team has already wiped or re-imaged compromised
machines by the time the responders arrive. Despite this, the evidence shows
that among the incidents investigated by Sophos, the exploitation of unpatched
vulnerabilities – such as ProxyLogon or ProxyShell – were the root cause for
almost half (47%) of cyberincidents investigated in 2021.


THE MAIN ATTACK TYPES

The release of ransomware is often the point at which an attack becomes visible
to the IT security team. It is therefore not surprising that 73% of the
incidents Sophos responded to in 2021 involved ransomware. Ransomware was also
the most prevalent attack type in 2020, at 82% (the higher number likely
reflecting the smaller data set). In the case of data exfiltration, accounting
for 1% of incidents, the incident responders believe these would probably have
unfolded into ransomware attacks but were caught and neutralized in time.



The second most prevalent type of attack uncovered by incident response
investigations was the broad category of “other intrusion,” which accounted for
23% of incidents. For the purposes of this report “other intrusions” are defined
as intrusions that have not resulted in ransomware or other tracked attack type.

An intrusion is often the result of an exploited unpatched vulnerability, such
as ProxyLogon and ProxyShell, but also includes the misuse of remote access
services or insecure VPNs, stolen account credentials or security oversights
(such as leaving entry points open to the internet).

The key thing is that the intrusions were detected and neutralized before a
major malicious payload was delivered to the target. It is reasonable to assume
that some, if not most, of these intrusions were excess inventory belonging to
IABs: “banked” access that had not yet been sold to another adversary. If the
intrusions had not been detected it is probable that a significant number would
have gone on to become ransomware attacks.

Cryptominers were the main attack type in 2% of the incidents investigated. The
presence of malicious cryptominers is often detected through their impact on
system performance, as the illicit coin mining draws processing power from
computers. It can be tempting to dismiss cryptominers as a lower-level, nuisance
threat, but the fact that they are in the network at all proves there is a
vulnerable entry point somewhere, and they can be a harbinger of more serious
threats to come.

The same applies to droppers and malware delivery systems in general, which are
designed to deliver, load, or install other malicious payloads to a target
system. They are enablers for an unfolding attack, providing a platform for
additional malicious modules such as backdoors and ransomware. Defenders
therefore need to treat the presence of droppers and malware delivery systems,
including Trickbot, Emotet and others, with the same seriousness as a major
ransomware group since they are often the precursors to bigger attacks.


A CROWDED PLAYGROUND

Attack types are not mutually exclusive. As mentioned earlier, multiple
adversaries, including IABs, ransomware gangs and cryptominers, can be found in
an individual target network at the same time.

For instance, while cryptominers were the main attack type in just 2% of
incident response cases, they were also present in 7% of ransomware incidents.
Cryptominers often scan for and remove other miners in infected networks but can
coexist comfortably with other threats, such as ransomware.

Simultaneous attack incidents reported by Sophos in 2021 include one involving
Atom Silo ransomware and two cryptominers, and a dual ransomware attack
involving Netwalker and REvil. This trend is continuing into 2022.


THE ADVERSARY TOOLBOX


REMOTE DESKTOP SERVICES ARE A MAJOR INTERNAL THREAT

RDP played a part in at least 83% of attacks, an increase from 2020 (when it
featured in 73% of attacks). Internal use featured in 82% of cases and external
use was seen in 13% of cases. This is against 69% and 32% respectively for 2020.

However, the way in which attackers used RDP is worth noting. In under three
quarters (70%) of incidents that involved RDP, the tool was used only for
internal access and lateral movement – a significant increase from 41% in 2020.

RDP was used for external access only in just 1% of cases, down from 4% in 2020;
and just 12% of attacks showed attackers using RDP for both external access and
internal movement, less than half the proportion from 2020 (when it was 28%).



The decline in the use of RDP for external access is likely to reflect improved
security, including disabling the service. However, RDP remains widely
accessible inside the perimeter, and hardening this access should be a key focus
for security teams.


THE ATTACK TOOLSET IN 2021

The chart below shows the “artifacts,” including tools, techniques, and
services, most likely to be found in an attacker’s toolset in 2021. Many of
these can also be used by IT professionals for benign purposes. They are popular
with adversaries because they allow them to conduct activities such as
credential stealing, discovery, lateral movement, and malware execution, and
more, while blending in with harmless everyday IT activity.

The number and nature of the artifacts highlight the challenge defenders face in
differentiating between malicious and legitimate activity on the network.

A deeper look at the most popular items used in attacks reveals the typical
playbook for cyberattacks in 2021.


THE ARTIFACTS THAT MAKE UP TOOLSETS

The artifacts identified during incident response investigations can be divided
into three categories: legitimate and hacking tools, Microsoft binaries, and
additional artifacts (scripts, techniques, services, and more).

The incident response investigations found 525 different artifacts overall, up
from from 132 in 2020 (although the base sample size was also larger),
comprising 209 legitimate and hacking tools, 107 Microsoft binaries, and 209
additional artifacts.

Legitimate and Hacking Tools

These include software that was used to assist in an attack. Cobalt Strike (48%)
and Mimikatz (28%) retain the top two spots from 2020, followed by AnyDesk
(22%), Advanced IP Scanner (19%), and ADFind (15%). Compared with 2020, Cobalt
Strike has increased its share (up from 37%), Mimikatz has remained steady
(holding at 28%), and three new tools have cracked the top five.

Cobalt Strike is a commercially produced exploitation tool suite designed to
help security teams recreate a wide range of attack scenarios. Attackers try to
establish a Cobalt Strike “beacon” backdoor on an infected machine. Beacons can
be configured to execute commands, download, and execute additional software,
relay commands to other beacons installed across a targeted network, and
communicate back to the Cobalt Strike server. Any detection of Cobalt Strike on
the network should be immediately investigated.

The second most widely seen tool, Mimikatz, was also originally designed as an
offensive security tool, and can steal passwords and other account credentials
to leverage in an attack.

Legitimate network scanners like Advanced Port Scanner and IP Scanner are used
to generate a list of IP and device names, which enables attackers to home in on
the victim’s most critical computing machines and infrastructure.

The misuse of the legitimate AnyDesk IT management tool is increasingly popular,
as it offers attackers direct control of the target computer, including control
over the mouse/keyboard and the ability to see the screen. Legitimate remote
access services such as TeamViewer, Screen Connect, Atera RMM, and Splashtop
also make the top cut in 2021.

Process Hacker, PCHunter and GMER are all legitimate tools that include kernel
drivers. If an attacker gets the right kernel driver installed they can often
disable security products.

Microsoft Binaries

Separating Microsoft tools from generic tools shows how attackers are living off
the land. These tools are all digitally signed by Microsoft. PowerShell (74%)
unsurprisingly tops the list, followed by PsExec (53%), “net.exe” (28%),
“rundll32.exe” (27%), and the WMI Command-line (WMIC) tool (22%). The use of
PowerShell, PsExec, and WMIC all increased in 2021, compared to 2020.

The tool “net.exe” was used in many phases of an attack, most commonly as a
discovery tool, while “rundll32.exe” was used extensively for execution and
defense evasion.

Other Microsoft tools that could point to an attacker lurking in the network are
“whoami.exe,” Task Scheduler (to maintain persistence), and “schtasks.exe” (to
execute malicious code.) The use of any such tools should be closely monitored.

Additional Artifacts

This category includes both tools and techniques, such as trying to disable
protection, vulnerabilities such as ProxyShell, use of cloud services such as
Mega.io, additional malware found, secondary infections, and transport protocols
used.

Malicious scripts (excluding PowerShell) were seen in 59% of the incidents
investigated. Malicious scripts are software code that enable malicious
activity. Examples of scripts misused by attackers include DOS/CMD batch and
command line scripts, Python scripts (a collection of commands in a file to be
executed like a program) and VBScripts (Visual Basic scripts that can be
executed in Windows or Windows Explorer.)

Web shells were the second most common type of threat found (in 38% of
incidents), with ProxyShell (28%) and ProxyLogon (11%) featuring prominently.
Installing services, disabling protection, dumping LSASS, creating rogue
accounts, modifying the registry, and clearing logs round out the top 10.


DATA EXFILTRATION

In 2021, Rclone entered the list of top artifacts used for exfiltration. Rclone
is a command line tool that connects to a wide variety of cloud storage
providers, such as Mega, and in 2021 it was the tool most widely used in data
exfiltration. Other cloud storage providers seen in this year’s data include
Dropbox, DropMeFiles, M247, pCloud, and Sendspace.

In addition to Rclone, tools found in incident investigations that aided data
exfiltration include Megasync, FileZilla, Handy Backup, StealBit, WinSCP, and
Ngrok.

The appearance of exfiltration tools in the top list in 2021 is not surprising
considering the fact that 38% of all incidents investigated involved the
exfiltration of data, up from 27% in 2020. A number of other incidents (8%
overall) showed signs of data being collected and staged for possible removal.
In cases where exfiltration took place, the evidence suggests that the stolen
information was subsequently leaked in 46% of incidents.

Attackers generally remove information as the final stage before deploying the
ransomware. Sophos’ incident analysis shows that in 2021 the median gap between
data exfiltration and the deployment of the ransomware was around 44 hours. The
mean average gap was just over four days (4.28 days) and the median gap was
under two days (1.84 days).

Regardless of which average is used, the important message here is that after
exfiltration there is a potential window of opportunity for defenders to prevent
the final and most damaging stage of the attack from unfolding. Any detection of
tools known to be used in data exfiltration should therefore be investigated as
a priority.


TOOL COMBINATIONS

The incident investigations revealed a pattern of tool combinations on victim
networks that provide a powerful warning signal for IT security teams
(comparative data for 2020 was available in some cases):

 * In 2021, PowerShell and malicious non-PS scripts were seen together in 64% of
   cases
 * PowerShell and Cobalt Strike combined in 56% of cases, compared to 58% in
   2020
 * PowerShell and PsExec were found in 51% of cases, compared to 49% in 2020
 * PowerShell, malicious scripts and Cobalt Strike were seen in 42% of cases
 * PowerShell, malicious scripts and PsExec were observed in 38% of cases
 * PowerShell, Cobalt Strike and PsExec occur in 33% of cases, up from 12% in
   2020
 * Cobalt Strike and Mimikatz were seen together in 16% of cases

Such correlations remain as important this year as they did last year, because
their detection can serve as an early warning of an impending attack or confirm
the presence of an active attack.


THE MAIN RANSOMWARE ADVERSARIES IN 2021

There were 41 different ransomware adversaries identified across the 144
incidents included in the analysis. Of these, around two thirds (28) were new
groups first reported during 2021. Eighteen ransomware groups seen in incidents
in 2020 had disappeared from the list in 2021, a clear indication of how very
crowded, dynamic, and complex the cyberthreat landscape has become, and how
difficult this can make life for defenders.

In many ways, 2021 “belonged” to Conti, a prolific RaaS operator that was behind
just under one in five (18%) of the incidents investigated by Sophos. It is
worth noting, however that REvil ransomware accounted for one in 10 incidents
overall, despite apparently stopping operations in July 2021 (reappearing
briefly in September, 2021, and again in 2022).

Other prevalent ransomware families during 2021 included DarkSide, the RaaS
behind the notorious attack on Colonial Pipeline in the U.S., and Black KingDom,
one of the “new” ransomware families to appear in March 2021 in the wake of the
ProxyLogon vulnerability.

Around a quarter (24%) of incidents in 2021, and 25% in 2020, were attributed to
other ransomware groups, while the remaining incidents couldn’t be attributed
with confidence to any known group.

Sophos has reported at length on Conti ransomware. A comprehensive list of
articles on Conti and other prevalent ransomware families, including LockBit,
Ryuk, and more, can be found in Sophos’ Ransomware Threat Intelligence Center.


CONCLUSION

Every organization is a target for an adversary somewhere, and, increasingly,
for more than one. From phishing and financial fraud, to botnet builders,
malware delivery platforms, cryptominers, IABs, data theft, corporate espionage,
ransomware, and more – if there’s a vulnerable entry point into a network, the
chances are that attackers are looking for it and will eventually find and
exploit it.

Until the exposed entry point is closed and everything that the attackers have
done to establish and retain access is completely eradicated, just about anyone
can walk in after them. And probably will.

Security teams can defend their organization by monitoring and investigating
suspicious activity. The difference between benign and malicious is not always
easy to spot. Technology in any environment, whether cyber or physical, can do a
great deal but it is not enough by itself. Human experience and skill and the
ability to respond are a vital part of any security solution.

The big incident response lessons of 2021 are how quickly and extensively
easy-to-exploit, widespread vulnerabilities are seized upon by adversaries,
contributing towards longer intrusions and multiple adversaries. For defenders,
these lessons mean that detecting, investigating and responding to the red flags
of known adversary toolsets and techniques are more critical than ever.


ADDITIONAL DATA TABLES


INCIDENT INVESTIGATION ARTIFACTS MAPPED TO THE MITRE ATTACK CHAIN

The tools, techniques, and other artifacts observed during incident
investigations were mapped against the MITRE ATT&CK framework. Further details
will be published in a companion article on Sophos News.


INCIDENT RESPONSE DEMOGRAPHICS 2021





 

Sophos Rapid Response helps organizations facing an active threat to contain,
neutralize and investigate the incident. You can contact Sophos Rapid Response
for emergency support 24/7.

 * Share on Facebook
 * Share on Twitter
 * Share on LinkedIn
 * 

About the Author


JOHN SHIER

John Shier is a Senior Security Expert at Sophos. John is a popular presenter at
security events, and is well-known for the clarity of his advice, even on the
most complex security topics. John doesn't just talk the talk: he also gives
hands-on technical support and product education to Sophos partners and
customers.


READ SIMILAR ARTICLES

May 24, 2021


WHAT TO EXPECT WHEN YOU’VE BEEN HIT WITH AVADDON RANSOMWARE

May 19, 2021


WHAT’S NEW IN SOPHOS EDR 4.0

May 19, 2021


SOPHOS XDR: DRIVEN BY DATA


LEAVE A REPLY CANCEL REPLY

Your email address will not be published. Required fields are marked *

Comment *

Name

Email

Website

Save my name, email, and website in this browser for the next time I comment.





Δ

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
Products and Services
Threat Research
Security Operations
AI Research
#SophosLife

You’re now subscribed!
Check your email to confirm your subscription.
Change Region
 * América Latina
 * Brasil
 * Deutschland
 * English
 * France
 * Iberia
 * Italia
 * Japan

Terms Privacy
 * Privacy Notice
 * Cookies

Legal
 * General
 * Modern Slavery Statement
 * Speak Out

© 1997 - 2022 Sophos Ltd. All rights reserved