Cybersecurity In-Depth: Digging into data about the latest attacks, threats, and trends using charts and tables.
Cisco's "Proven Success Factors for Endpoint Security" report takes a close look at critical-severity indications of compromise alerts.
Cisco Secure Endpoint leverages a protection lattice composed of several technologies that work in concert. One of those layers is the Indication of Compromise (IoC) feature, which can detect suspicious behaviors observed on endpoints and look for patterns related to malicious activity. Cisco Security aggregated this data across organizations from events detected in the second half of 2020 and filtered the analysis down to critical-severity IOCs. While critical-severity IOCs make up a small portion (under 5%) of the overall IoC-based alerts, they typically demand immediate attention if observed on the endpoint. After sorting the critical-severity IoCs observed, the most common category was dual-use PowerShell tools. These are tools designed to make it easier for IT teams to complete their tasks, but they can also be used for both exploitation and post-exploitation tasks. PowerShell Empire, Cobalt Strike, PowerSploit, and Metasploit are four such tools commonly seen.
Read the full Proven Success Factors for Endpoint Security report for more key findings.
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024