FireEye Offers Free Tool to Detect Malicious Remote Logins
Open source GeoLogonalyzer helps to weed out hackers exploiting stolen credentials to log into their targets.
FireEye today released an open source tool called GeoLogonalyzer for catching remote logins from hackers.
Stolen enterprise user credentials are all the rage among hackers these days, but spotting the bad guys among legitimate users logging in remotely can be difficult due to the large volume of remote access links to an organization.
David Pany, senior consultant at Mandiant, a FireEye company, says the tool helps analyze logs to spot geographically infeasible logins: flagging a New York-based user logging in at 13:00 and a few minutes later connecting to a VPN from Australia, for example. "Once remote authentication activity is baselined across an environment, analysts can begin to identify authentication activity that deviates from business requirements and normalized patterns," Pany said in a blog post today announcing the new free tool.
Other anomalies that could indicate hackers are logging in include user accounts registered to a single physical location that have logons from locations where the user is not likely to be sitting, as well as logons from different source-host names or via multiple VPN clients.
FireEye recommends several best practices for thwarting remote access hacks in addition to deploying GeoLogonalyzer, including limiting remote access from the Internet to sensitive data; instituting multifactor authentication using one-time tokens; and whitelisting legit IP address ranges for remote access users, among other steps.
GeoLogonalyzer is available under the Apache License 2.0 here via GitHub.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024