Exchange Vulnerability May Have Led to Attack on NetStandard MSP
Organizations should implement MITRE ATT&CK detections for T1595 to alert on reconaissance and T1505.003 to alert on attempts to install malicious software.
-
-
Leveraging Automation and MITRE ATT&CK to Eliminate Detection Coverage Gaps in Your SOC
SecurityGuyTV interviews Phil Neray, CardinalOps VP of Cyber Defense Strategy at at Black Hat USA
-
CardinalOps Shortlisted for Best Security Innovation Category in 2022 SaaS Awards
Platform uses automation and MITRE ATT&CK to address to address complexity headaches of managing SIEMs (Splunk, Microsoft Sentinel, IBM QRadar, etc.).
-
CardinalOps Sponsors SANS Webinar with Google’s Dr. Anton Chuvakin and Critical Start’s Randy Watkins on “Demystifying SIEM, EDR, XDR & MDR”
CardinalOps sponsors a live SANS webinar to help security operations professionals decipher the alphabet soup around SIEM, EDR, XDR, and MDR.
-
How the Colonial Pipeline Attack Changed Cybersecurity
Raised visibility for mitigations such as network segmentation, which MITRE ATT&CK categorizes as essential to preventing access to safety-critical systems.
-
CISA Argues Against Disabling PowerShell
PowerShell used in MetaSploit, Trickbot, and Emotet attacks as well as by HAFNIUM and the Lazarus Group. MITRE ATT&CK has a dedicated technique for PowerShell.
-
Microsoft Disables Iran-Linked Lebanese Hacking Group Polonium
Fancy Bear also targeted VPNs in 2018. SIEM mitigations for MITRE ATT&CK T1133 External Remote Services: examine authentication logs for unusual access patterns.
-
SIEMs not detecting a huge percentage of MITRE ATT&CK techniques
CardinalOps 2022 SIEM Detection Risk report shows SIEMs missing detections for 80% of MITRE ATT&CK techniques; 15% of SIEM rules are broken and will never fire.
-
Colonial Pipeline Ransomware Attack: Lessons for Technologists
Eliminate monitoring blind spots in your SIEM using MITRE ATT&CK.
-
Enterprise SIEMs Fall Short on Detecting Attacks
75% of organizations that forward identity logs such as Active Directory and Okta to their SIEM, do not use them.
-
Enterprise SIEMs are Missing Detections for 4 out of 5 of All MITRE ATT&CK Techniques
Second annual report analyzed production SIEM instances to understand SOC preparedness to detect latest adversary techniques in MITRE ATT&CK.
-
Data Shows Enterprise SIEMs Detect Fewer Than 5 of the Top 14 MITRE ATT&CK Adversary Techniques Used in the Wild
Actual coverage remains far below what most organizations expect; organizations unaware of gap between their assumed security and defenses actually in place.