3 ms·
Fast-acting cyber gangs increasingly disabling telemetry logs
- throwaway290 3y agoThe numbers have got to be underreported, if there are no logs the chances of attack being spotted in the first place...
- sonicanatidae 3y agoThis. If there are no logs and nothing noticeable about the exfiltration, then it's not reported, because it's unknown.
- theultdev 3y agoSo fluff about logs being deleted to do their security sales pitch. No stance, just noting what it is. Main sales pitch here: “We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen. “Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”
- ghostpepper 3y agoSince this article inexplicably doesn't link to the source material https://news.sophos.com/en-us/2023/11/14/active-adversary-for-security-practitioners/ https://news.sophos.com/en-us/2023/11/14/active-adversary-fo...
- pdntspa 3y agoCovering your tracks is red team 101 right? How is this notable?
- chankstein38 3y agoMy thoughts exactly. I'm confused how this is news
- lancesells 3y agoI didn't know about this so it's news to me.
- _8j50 3y agoIt shouldn't be, what the GP commentsr said isn't correct. You should be stealthy not break your stealth and create a mess cleaning up after yourself.
- lancesells 3y agoWhy not? This isn't my area of expertise or knowledge. Articles like this inform me. Sure, it's maybe logical when you have time to think about this but this would be news to more people than not.
- _8j50 3y agoBecause defenders also look for attempts to clear your tracks and catch you. Normal things don't clear their tracks. And by defenders that includes antivirus/malware software.
- jstarfish 3y ago> Covering your tracks is red team 101 right? Yes, but surprisingly few adversaries actually do this so if it's being observed in the wild, it's a notable development.
- sonicanatidae 3y agoYes and no. Logging is getting better and can be shipped off-site. Additionally, they would usually have to crack multiple passwords, to gain the access needed to all the devices that log. The firewall, for example, should NOT be Radius and should local auth, so if someone gains AD creds, they don't have access to the firewall, too. In IT there are 1000s of ways to skin a specific cat, and everyone has their own, so I'm not touting mine as "The way". I'm simply stating that "cleaning up logging" isn't as simple as it sounds, when it really comes down to it.