This post is also available in: 日本語 (Japanese)
This is based on a true story. “Fred” did not depart from his employer with good intent: For years, he kept coming back and exfiltrating the company’s intellectual property. The moment of truth came four years later, when the company deployed Cortex XDR.
An IT admin for a large multinational American corporation, Fred had been let go four years prior. Knowing the IT group inside and out, he suspected that his ex-colleagues forgot to disable his VPN account. To test it, he used his VPN credentials from his private computer and surprise: He successfully logged in!
He knew his company’s network very well. He also knew what he was looking for and where to find it. So, for the next four years, he kept coming back to exfiltrate the latest source code from the company’s Git repositories.
Moving from VPN to Source Repositories via an SSH Tunnel
Logging in through VPN, he gained access to the VPN subnet. He now needed to get into a different subnet to access the Git repositories with the latest source code. He knew that an old Windows PC used for testing was still running and could provide a way to get there. Fred accessed the workstation with Microsoft’s Remote Desktop and set up a PuTTY SSH tunnel to the Git server. He could now pass Git traffic from one subnet to another using the Windows PC as a proxy. He started to exfiltrate source code from the protected subnet, back to a server he’d set up on the internet.
AI Wakes Up
When Cortex XDR’s machine learning (ML) engine was deployed, it was trained on network, cloud and endpoint events for a period of time to establish a baseline and identify the behavioral limits beyond which an alert is raised.
As soon as this initial training period was over, Cortex XDR’s analytics confidently identified the uncommon tunneling process, declaring that the tunneling and RDP processes were abnormal behavior patterns on this network. Even though this behavior had been happening over the past four years, it was still recognized as suspicious: Cortex XDR’s analytics not only compared behavior with past trends of the same entity but also to its peer group (in this case, other workstations).
Our Obsession with Data Leads to Fewer Alerts for the SOC
Cortex XDR also noted that the PC tunneling data between the internal network and a host on the internet was an unmanaged device (i.e., no Traps agent).
Machine learning starts with rich context. Our data science team’s perspective on the topic is:
“If we don’t have enough data for analysis, we run the extra mile to collect it.”
So, instead of alerting the SOC team prematurely at this point, Cortex XDR dispatched Pathfinder, its lightweight user-mode agent, to collect more data on the workstation and complete the partial analysis cycle. Not having an agent on the server isn’t enough of an excuse to raise a half-baked alert and overload the SOC team with partial results, generating extra manual investigation tasks.
Pathfinder swiftly arrived, deployed and performed its data collection on the workstation. It took a snapshot of all running processes, all active incoming and outgoing network sessions, users logged in to the computer and uncommon domains in communication. As it collected data, it streamed the results to Cortex Data Lake for Cortex XDR to finish up its analysis. It didn't take long for the ML engine to raise the flag:
- Local process socket usage information showed both internal and external (proxy) open sockets to an uncommon domain.
- This proxy detection model compared the process initiating the VPN connection, the tunneling behavior, the destination IP address and over 10 other factors with the rest of the organization, and found the behavior to be suspicious. It was now apparent that the organization was facing a threat.
- Cortex XDR issued an alert to the SOC, accompanied by all important details to explain what had been happening.
We heard this story shortly after the organization’s SOC received the first alert from their brand-new Cortex XDR proof-of-concept. And that is how this article was born.
ML and Holistic Thinking Wins
Beyond displaying Cortex XDR's ML models that adapt to each customer’s environment, this story emphasizes how crucial rich data collection is across the network and endpoint. Cortex XDR’s obsession with collecting missing data, combined with its holistic approach of stitching network and endpoint events together for rich context, results in better detection and deeper insight as well as ensures that our customers only see the alerts that matter.
The Cortex Data Science team's pledge to reduce your alert fatigue keeps driving us to create a world where each day is safer and more secure than the one before. Learn more about Cortex XDR.
Read more stories in the Busted by Cortex XDR series.