Critical-Severity IoCs Observed at the Endpoint

Cisco Secure Endpoint leverages a protection lattice composed of several technologies that work in concert. One of those layers is the Indication of Compromise (IoC) feature, which can detect suspicious behaviors observed on endpoints and look for patterns related to malicious activity. Cisco Security aggregated this data across organizations from events detected in the second half of 2020 and filtered the analysis down to critical-severity IOCs. While critical-severity IOCs make up a small portion (under 5%) of the overall IoC-based alerts, they typically demand immediate attention if observed on the endpoint. After sorting the critical-severity IoCs observed, the most common category was dual-use PowerShell tools. These are tools designed to make it easier for IT teams to complete their tasks, but they can also be used for both exploitation and post-exploitation tasks. PowerShell Empire, Cobalt Strike, PowerSploit, and Metasploit are four such tools commonly seen.

Read the full Proven Success Factors for Endpoint Security report for more key findings.