Understanding the intricacies of a cyber attack is one of the most complex
and costly challenges security teams face. Let's examine a common security
event. An endpoint is trying to communicate with a hackers command and
control server indicating it's infected. However, nothing is detected by the
antivirus. In this situation we need to quickly determine: is this a real
infection? Is there a data breach? How can we remediate it? How did the infection get in?
Answering these questions can be extremely complicated. SandBlast agents
forensics technology is built to address this exact challenge. Let's see it in
action. SandBlast agent detected and blocked the command and control
communication and was generated an alert log. Clicking on the forensics link takes
us to the event analysis. The first thing we wanted to know was if this is a real
attack the suspicious activity section shows multiple events, some with high
severity. It's obvious this is a real infection.
The malware actions are explained in simple terms we can easily understand
for example Windows Firewall tampering. Tampering with the Windows Firewall is a
highly irregular activity for legitimate programs. Expanding the activity shows
the specific forensic details like the altered registry keys. Next we wanted to
know if there's been a data breach. For this let's examine the business impact
section. We click for the details and search to find if specific files were breached.
We now want to remediate the infection the remediation section shows
that the malicious elements have been quarantined. SandbBlast agent has already
remediated the system, in fact, SandBlast agent can automatically remediate virtually
any infection. Even if it's an unknown or zero-day attack. Finally, to prevent
future infections we need to understand how the attack entered. The entry points
section provides a breakdown of how the malware penetrated. In this case a zip
file was downloaded during a chrome browsing session. The user extracted and
executable from the zip and launch deck. The executable file is the start of the
infection. As we've seen SandBlast agent immediately provided us with simple and
straightforward answers to the key questions. What traditionally would have
taken hours or days of a forensic expert, was automatically analyzed and presented
in the report overview. Note that analysis can be
triggered not just by Sandblast agent detection but also, from a wide range of security alerts.
For further insight the incident details section allows us to gain a deeper
understanding of the incident. But, keep in mind SandBlast agent has
automatically distilled mountains of forensic data into the simple view.
With a quick glance we see the entire infection starting with the malicious
executable that the user extracted from the zip and ending with the process that
attempted to communicate with a command and control server.
Notice the SandBlast agent understands and tracks malware behavior. For instance,
we can see the malware dropping a malicious executable.
And here it's persisting itself to run after boot. We see here in an attempt to
evade detection the malware has injected a trusted application, Windows Explorer,
to perform some of its malicious activities.
The report also highlights the point of damage here the attack is accessed in red data files.
That's the power of SandBlast agent forensics technology. From a single Security Alert,
SandBlast is able to offer clear actionable understanding of the attack.
As well as infection remediation, it saves critical time, enabling security
teams to focus on the optimal response.
Forensics is a key part of SandBlast agent, checkpoints advanced threat
prevention solution for endpoints. For more information visit checkpoint.com/sandblastagent