Cybersecurity In-Depth: Digging into data about the latest attacks, threats, and trends using charts and tables.
Critical-Severity IoCs Observed at the Endpoint
Cisco's "Proven Success Factors for Endpoint Security" report takes a close look at critical-severity indications of compromise alerts.
Cisco Secure Endpoint leverages a protection lattice composed of several technologies that work in concert. One of those layers is the Indication of Compromise (IoC) feature, which can detect suspicious behaviors observed on endpoints and look for patterns related to malicious activity. Cisco Security aggregated this data across organizations from events detected in the second half of 2020 and filtered the analysis down to critical-severity IOCs. While critical-severity IOCs make up a small portion (under 5%) of the overall IoC-based alerts, they typically demand immediate attention if observed on the endpoint. After sorting the critical-severity IoCs observed, the most common category was dual-use PowerShell tools. These are tools designed to make it easier for IT teams to complete their tasks, but they can also be used for both exploitation and post-exploitation tasks. PowerShell Empire, Cobalt Strike, PowerSploit, and Metasploit are four such tools commonly seen.
Read the full Proven Success Factors for Endpoint Security report for more key findings.
About the Author(s)
You May Also Like
Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024