di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

<p>Perspective & Findings</p>

<h4>Deep Instinct Included in the 2022 Gartner®<span>&nbsp;</span>Magic Quadrant™<span>&nbsp;</span>for Endpoint Protection Platforms (EPP)</h4>

gartner-mq-2022-pr.jpg

Listing preview

Perspective & Findings

<h4>Deep Instinct Included in the 2022 Gartner®<span> </span>Magic Quadrant™<span> </span>for Endpoint Protection Platforms (EPP)</h4>

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

<p>We’re thrilled to announce our inclusion in the 2022 Gartner Magic Quadrant for Endpoint Protection Platforms (EPP).</p><p>As the only new vendor recognized in the Magic Quadrant for EPP last year, we believe our inclusion reinforces our position that the EPP status quo is ripe for disruption in a market that has over-rotated towards a reactive detection and response approach.</p><p>Deep Instinct’s innovative deep learning approach is filling a gap in the market to prevent unknown threats missed by other solutions. Our mission is to prevent-first and <a href="/endpoint-detection-response" target="_self">augment EDR solutions</a> to reduce the overall events that need investigation, lower risk, and improve the lives of SOC teams everywhere.</p><p>With the continued climb in breaches, zero-days, and successful ransomware attacks, we believe EPP solutions must adopt a prevention-first mindset with proactive AI to turn the tides on bad actors.</p><h3>The start of a revolution: Prevention-first</h3><p>Deep Instinct takes a different approach to EPP: preventing unknown malware before it can get inside your environment, with the only native deep learning-based solution.</p><p>To underscore the need for a more proactive approach to cybersecurity you don’t have to look further than the <a href="https://www.ibm.com/reports/data-breach?utm_content=SRCWW&p1=Search&p4=43700072379268622&p5=p&gclid=Cj0KCQjw--2aBhD5ARIsALiRlwBFTwvdWGfzwBjj8K8QEHBkVMKg1cgkvQ7rXxggqVcYyDKshixt7ZAaAk5DEALw_wcB&gclsrc=aw.ds" target="_blank">IBM 2022 Cost of Data Breach Report</a></p><ul><li>The average cost of data breaches is now $4.35 million globally – up 2.6% from the previous year.</li><li>The United States incurred the highest costs, with an average total of $9.44 million.</li><li>60% of businesses had to the increase in cost of their products in response.</li></ul><h3>The Unknowns and Assume Breach challenges</h3><p>The industry is seeing ransomware and other threats continuing to increase is great part because today’s solutions are built to detect, not prevent, and are therefore too reactionary.</p><p>The focus over the last decade has been mainly focused on assume breach/detection-first and has not stopped attacks from succeeding. There are a few reasons to point to as an explanation:</p><ul><li>Attackers are learning new ways to evade the controls meant to stop them.</li><li>Ransomware and zero-day attacks are being missed.</li><li>Overworked and understaffed security teams have too many alerts to handle and triage.</li><li>A high rate of false positives impacts a solution’s effectiveness.</li><li>It takes too long to detect a threat and time is not on our side.</li></ul><p>Case in point is the more recent XDR movement. While XDR has the amiable goal of a more integrated ecosystem, with more telemetry there will also be more data to sift through post detection, delaying decisions. This post-execution analysis will prove to be a challenge especially in a large enterprise. XDR will be useful for remediation and response, but not where the biggest problem lies – preventing the attack from getting inside in the first place.</p><p>The market is calling for greater protection and needs true prevention capabilities. Deep Instinct expects to see a shift in priorities as SOC organizations realize they can truly prevent more events to minimize business disruption and lighten their workload by reducing the need to chase alerts and react to false positives.</p><h3>How Deep Instinct is changing outcomes with prevention-first</h3><p>Deep Instinct is the only EPP vendor that is laser-focused on a prevention-first approach and the only vendor to natively develop a deep learning framework dedicated to cybersecurity. We believe our unique approach is the key to changing the game against attackers and providing dramatically different outcomes.</p><p>Deep Instinct is helping our customers combat these challenges:</p><ul><li>Prevent threats before they can fully execute and land inside your environment</li><li>Prevent ransomware, zero day, and other unknown threats in &lt;20ms</li><li>Increase SOC efficiency by reducing false positives to &lt;0.1%<ul><li>Improve SOC effectiveness with fewer events to react to</li><li>Provide time to focus on what really matters to the organization</li><li>Lower the volume of telemetry threat hunters must parse to string together related events</li></ul></li><li>Improve efficacy without relying on cloud checks for threat intelligence</li><li>Lower total cost of ownership with reduced remediation efforts and minimal maintenance</li></ul><h3>Prevention-first outcomes</h3><p><a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">Unit 221B, a cybersecurity consultancy, tested and evaluated Deep Instinct’s claims</a>. This team of ex-hackers and self-described skeptics put Deep Instinct through the wringer and came away with proof of the efficacy of the solution. Unit 221B validated Deep Instinct by several methods, including creating its own unique malware to bypass our prevention. The results speak for themselves.</p><p></p><blockquote class="ml-3 pl-3 border-l">“Deep Instinct was able to showcase why deep learning is a revolutionary technology for fighting and predicting the attacks of tomorrow, while maturing your security posture today.”<br/>- Lance James, CEO, Unit 221B</blockquote><p></p><p><a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">Unit 221B Key findings</a> include the following:</p><ul><li>99.78% Accuracy - Deep Instinct exhibited a combined 99.78% accuracy rate for detection and prevention across unknown and custom attacks. Unit 221B tested Deep Instinct with a recommended configuration suitable for a mature customer’s hardened environment.</li><li>100% of Unknown Attacks - Deep Instinct successfully prevented 100% of unknown attacks and 96.4% of Unit 221B’s customized attacks.</li><li>60% Reduction - In events/alerts recorded to SIEM/EDR solutions with Deep Instinct installed compared to <a href="/vs-microsoft-defender" target="_self">Microsoft Defender alone</a>. This results in less strain on staffing and lowering of alert fatigue levels, allowing staff to be more focused on strategic and critical tasks such as patching and system hardening.</li></ul><h3>It’s time for a change.</h3><p>Deep Instinct set out to drive better outcomes and improve security for organizations of all sizes as an agent on the endpoint or deployed with our REST API to protect file uploads.</p><p>The status quo reactionary approach is taking a toll on <a href="/voice-of-secops-reports" target="_self">cybersecurity leaders and their staff with many thinking of leaving the industry</a> altogether at a time when staffing shortages are growing worse. We must think differently about the problem if we expect different outcomes. Taking a prevention-first approach to stopping more attacks, earlier and faster, is possible due to Deep Instinct’s innovation steeped in deep learning.</p><p>To learn more: <a href="https://info.deepinstinct.com/gartner-mq-2022" target="_blank">https://info.deepinstinct.com/gartner-mq-2022</a></p><p>Gartner, Magic Quadrant for Endpoint Protection Platforms, Peter Firstbrook, Chris Silva, 31 December 2022.</p><p></p><p><em>GARTNER is a registered trademark and service mark, and Magic Quadrant and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.</em></p><p><em>Disclaimer: Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.</em></p><p><em>Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.</em></p>

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

file-upload-security-blog.jpg

<p>While most cybersecurity strategies are focused on the endpoint there is an overlooked risk that needs attention: <strong>your application file uploads</strong>.</p><p>Applications are the backbone of modern business, with thousands (if not millions) of files uploaded and downloaded every day. If those files contain malware they pose a significant risk as they traverse through an organization’s IT infrastructure and end up stored in local or cloud repositories.</p><p>Most organizations have challenges addressing these risks, such as:</p><ul><li>Files not being scanned at all</li><li>Files scanned with legacy tools that cannot keep up with the changing threat landscape</li><li>Security that slows down or interrupts business processes</li><li>Scanning tools that can’t scale up to enterprise volumes (up to 10s of millions of files daily)</li></ul><p>If a malicious file is downloaded and allowed to run, the attack begins, and it's a race to stop it before a breach. The struggle is that traditional security approaches are ineffective and unknown malware is easily passing through. Waiting until it ends up in storage and hits the endpoint is far too late.</p><p>Read the full report: <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a></p><h3>File Uploads in the Enterprise: A Business Risk</h3><p>Organizations must accept files through their web applications to run their business. But files uploaded by customers or end users could contain malware. In fact, <a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_blank">80% of successful breaches</a> come from <a href="/zero-day-attacks" target="_self">new or unknown zero-day attacks</a>. These attacks most often come from the exploitation of undisclosed vulnerabilities or evolved malware variants that infiltrate a system unrecognized. Gartner states in their report on file upload security:</p><p></p><blockquote class="ml-3 pl-3 border-l">“…if the application provides access to a large number of external users, security leaders should require an application design that protects against the abuse of the channel for uploading malware.”</blockquote><p></p><p>File upload security is an ever-increasing necessity in today’s business environment. There are several traditional approaches that exist, but each has its individual drawbacks.</p><h3>How Traditional Security Approaches Fall Short</h3><p>There are four common approaches to preventing malicious file uploads: Traditional anti-virus (AV), multi-AV, file sandboxing, and content disarm & reconstruction (CDR). Each solution approaches the problem uniquely, but all fall short of providing complete protection.</p><p>In a nutshell, single AV won’t catch new malware variants, multi-AV suffers the same problem, sandboxing causes delays that are not acceptable to the business, and CDR (while effective) often manipulates and destroys content and requires numerous business exceptions creating an administrative nightmare.</p><p>Further drawbacks of AV, Sandbox, and CDR solutions include the following:</p><ul><li>Business disruption</li><li>Scalability issues</li><li>Low unknown malware catch rate coupled with high false positive rate</li><li>Limited number of file types scanned</li><li>Vast CPU and infrastructure resource requirements</li></ul><p>For a more in-depth analysis, check out the blog post: <a href="/blog/top-3-drawbacks-of-content-disarm-reconstruction-cdr-for-malware-prevention" target="_self">Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention</a>.</p><h3>A New Approach: The Requirements</h3><p>To meet the demands of today’s enterprise and cloud-first organizations, a better solution is needed. The solution needs to quickly scan files and return a verdict without an impact on business operations or SOC team productivity.</p><p>The most advanced AI, Deep Learning, is a core requirement to create a solution that autonomously prevents unknown malware. A solution natively architected with Deep Learning can achieve the following:</p><ul><li>Scan tens of millions of files per day with &lt;0.1% false positives</li><li>Prevent &gt;99% of unknown malware, whether offline or online</li><li>Deliver decisions without a reliance on cloud threat intelligence feeds</li><li>Protect data privacy and file integrity</li><li>Scale to meet throughput needs of the largest enterprises</li></ul><p>Align to business requirements with minimal friction by providing:</p><ul><li>Flexible, deploy-anywhere model via a Docker container cluster</li><li>Reduced TCO by lowering CPU usage and infrastructure requirements</li><li>REST API or ICAP integration for DevOps to easily connect applications to scan files</li><li>Low AI model maintenance with only 2-3 updates needed per year</li></ul><h3>Enter Deep Instinct Prevention for Applications</h3><p><a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> is an agentless, antimalware file scanning solution that was architected with deep learning at its core. Deployed in a container cluster and integrated via API or ICAP, Deep Instinct provides the flexibility and scale that meets the demands of the largest enterprises.</p><p>Deep Instinct Prevention for Applications is already scanning tens of millions of files per day for some of the largest organizations in the world. Our customers are experiencing scan speeds of &lt;20ms per file and false positive rates well under &gt;0.1%. In addition, they are finding &gt;99% of unknown malware is stopped before it enters their environment, better protecting themselves and their customers.</p><p>For a more in-depth discussion of file upload security and how traditional approaches are not enough, check out our <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a> report.</p><p>For more reading about threats lurking in file uploads:</p><ul><li><a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">Emotet is back</a></li><li><a href="/blog/no-macro-no-worries-vsto-being-weaponized-by-threat-actors" target="_self">VSTO takes over where macros left off</a></li><li><a href="/blog/top-3-drawbacks-of-content-disarm-reconstruction-cdr-for-malware-prevention" target="_self">CDR drawbacks</a></li></ul><h3>RESOURCES</h3><ul><li><a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_blank">The Third Annual Study on the State of Endpoint Security Risk</a></li><li><a href="https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/cross-site-scripting-via-file-upload" target="_blank">Cross-site Scripting Via File Upload</a></li><li><a href="https://dataprot.net/statistics/malware-statistics" target="_blank">A Not So Common Cold: Malware Statistics in 2022</a></li><li><a href="https://www.apriorit.com/dev-blog/545-sandbox-evading-malware" target="_blank">Malware Sandbox Evasion: Techniques, Principles & Solutions</a></li><li><a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">What is Content Disarm and Reconstruction (CDR)?</a></li></ul><p></p>

Don’t Let Application File Uploads Become Malware Downloads

ML-DL-blog.png

<p>When it comes to minimizing risk, organizations have been turning to AI-based solutions to detect and respond to attacks because humans cannot keep up with their variety, volume, and velocity. The majority of AI-based cybersecurity solutions feature some form of machine learning (ML). Yet, we continue to experience far too many breaches. There is an opportunity for a transformational change to adopt superior threat prevention, brought about by the most advanced form of AI – deep learning (DL).</p><p>But what is deep learning, and why should you care?</p><p>There are significant differences between ML vs DL – and when applied to cybersecurity, it’s critically important to understand the outcomes each can achieve and the key benefits of each approach.</p><p>Deep Instinct’s most recent eBook delves into these differences: <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_self">How do DL and ML solutions truly compare and which is superior for advanced threat prevention?</a></p><h2>The evolution of machine learning in cybersecurity</h2><p>There are essentially three types of AI that are used in cybersecurity: Basic, Reactive, and Proactive.</p><p>As the story goes, traditional AV and NGAV were failing to prevent attacks. These solutions adopted basic AI to improve prevention, but still relied on signatures and rules to stop known attacks. By time the rules are updated, the attackers have long since modified the attack and changed tactics. In the innovation race between threat actors and cybersecurity vendors, the vendors have been a distant second for some time.</p><p>Around 2010, it was determined that ‘assume breach’ was the most logical mindset to react to cybercriminals. If it was not possible to keep the bad guys out, planning for the inevitable breach was the appropriate defense. They are going to find a way inside your environment, and solutions were built to look for behaviors of compromise and known attack techniques, employing a reactive form of AI called machine learning. Rather than stop attackers at the gates, the decision was made to assume they would break through defenses and the best plan was to deal with the aftermath post-attack.</p><p>While ML was a perceived step forward in the evolution of cybersecurity, we have now come to a point where it is not enough. More attacks are succeeding and increasingly <a href="/blog/edr-bypass-techniques-and-how-to-stop-them" target="_self">evading the security controls, like EDR,</a> meant to stop them. The investments made in cyber solutions that do not stop cybercriminals in addition to the post-attack costs are no longer tenable.</p><p>This is evidenced in a recent article, "EDR evasion is well-documented, but more as a craft than a science," by Karsten Nohl, chief scientist at Berlin-based SRLabs. Nohl observed, "What's new is the insight that combining several well-known techniques yields malware that evades all EDRs that we tested. This allows the hacker to streamline their EDR evasion efforts."</p><h2>5 ways deep learning is transforming cybersecurity</h2><p>Deep Learning holds the greatest promise to proactively prevent threats before attackers can get inside and establish a foothold. While some aspects of ML- and DL-based cybersecurity platforms may appear similar, the significant differences lie in the outcomes.</p><p>For a more in-depth explanation of ML vs DL, <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_self">read the eBook</a>.</p><ol><li><strong>Prevention, pre-execution</strong><br/>A DL-based solution can provide instantaneous prevention of ransomware, zero-days, and other unknown attacks before a file executes and lands on the operating system – meaning it never gets the chance to detonate. Deep Learning makes it possible to prevent a threat in &lt;20ms, before it can write to disk, virtually eliminating the threat actors ability to evade controls.</li><li><strong>Reduction in false positive rate to &lt;0.1%</strong><br/>With an industry low false positive rate, DL-based solutions deliver far fewer alerts overall, which alleviates the burden on the SOC team so that they can focus on the most pressing issues impacting the business.</li><li><strong>Autonomous, accurate decisions without the cloud</strong><br/>A DL ‘brain’ is trained on all available raw data to understand the DNA of an attack. This enables a DL-based cybersecurity solution to make malicious vs benign decisions autonomously without the need to call to the cloud for intelligence feeds.</li><li><strong>Lower resource requirements and less maintenance</strong><br/>DL-based solutions consume far less memory and lowers CPU consumption even with the speed and scale with which it can make decisions. The ‘brain’ can prevent never-before-seen threats without constant tuning and only requires 2-3 updates per year.</li><li><strong>Immense scalability</strong><br/>Because of its autonomy, speed, and lightweight footprint, a DL-based solution is able to scale to scan tens of millions of files in milliseconds while still maintaining an extremely low false positive rate.</li></ol><h2>Machine learning vs deep learning: Under the hood</h2><p>On the surface it’s all AI, <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_self">so how is Deep Learning really different</a>? Much of it has to do with the data the models can train on and how much human bias can be eliminated.</p><figure style = "float: none;width: autopx;max-width:auto;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0bb495d562d39b3e/631750ac52ab8f55abfa76cf/ML-DL-infographic.png" alt="Machine learning vs deep learning: Under the hood" /></figure><h2><br/>Defense-in-depth with deep learning</h2><p>ML was once the most efficient, cutting-edge AI available — but we have come to realize that it’s too reactive. ML-based solutions, like EDR, are needed for investigation, correlation, and response, but we can vastly improve the outcomes and efficiency of the SOC by incorporating a prevention-first approach in the security stack. A DL-based solution can prevent malicious files uploaded by customers, third-party partners and end users, or downloaded from the internet, by scanning them before they reach the endpoint, server, or storage with zero impact on business operations.</p><p>To learn more about the differences between ML and DL solutions, and to understand how Deep Instinct can help protect your organization from the world’s most advanced threats, read our <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_self">eBook: Deep Learning vs. Machine Learning in Cybersecurity; Which is Superior for Advanced Threat Prevention?</a></p><p>If you’d like to learn more about our deep learning capabilities, including our industry-best $3M no-ransomware guarantee, we’d be delighted to <a href="/request-a-demo" target="_self">give you a demo</a>.</p>

5 Advantages of Deep Learning  in Cybersecurity

ransomware-macos-windows.png

<p>While it may be true that macOS computers are more secure than Windows-based machines, the advantage is less than you might think. Apple has done a good job of building security into macOS to stop known attacks, but the real challenge is in stopping new, never-before-seen malware (the unknowns) that can lead to ransomware or zero-day attacks. To highlight this problem, Ponemon’s <em>Third Annual Study of Endpoint Risk</em> reported that <a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_self">80% of breaches involved new or evolved malware variants </a>that infiltrate a system unrecognized or exploit undisclosed vulnerabilities.</p><h2>Increase of ransomware attacks on macOS</h2><p>In 2019, threat actors took a run at macOS and <a href="https://dnetc.net/mac-malware-threats-rise-60-in-quarter/" target="_self">threats jumped by 60%.</a> Since then, there have been repeated attempts and a few ransomware attacks aimed at macOS. Fortunately, we have not yet seen a major breach. In 2020, <a href="https://www.forbes.com/sites/daveywinder/2020/02/11/platform-wars-2020-apple-security-threats-outpace-microsoft-windows-for-first-time/?sh=4ea80adb7c5a" target="_self">Forbes reported that Mac malware outpaced Windows by 2 to 1</a>. In 2021, we saw an overall rise in malware developed to attack macOS like ElectroRAT, Silver Sparrow, and XLoader. These new malware strains have been paving the way for an increase in sophisticated and profitable attacks aimed at macOS, namely ransomware.<br/></p><blockquote class="ml-3 pl-3 border-l">“There is still a lingering misperception that Macs are inherently more secure than Windows systems, because of the raw numbers of attacks," Leichter says. That sentiment is largely a reflection of the current market share, where Windows still dominates. "Macs do have some security advantages, but these are becoming less significant because of two trends: malware is increasingly targeting browser plugins, not the underlying OS," he adds. In addition, he says, malware developers are increasingly creating cross-platform applications independent of the operating system.<div class="quote-reference"><a href="https://www.darkreading.com/vulnerabilities-threats/new-mac-malware-samples-underscore-growing-threat" target="_self">Dark Reading</a>, January 2022</div></blockquote><p></p><p>According to the <a href="https://www.datto.com/blog/dattos-global-state-of-the-channel-ransomware-report-2018" target="_self">State of the Channel: Ransomware Report</a> from Datto, MSPs have seen a rise in ransomware on both macOS and iOS devices, equating to a 500% increase from the previous year. The problem is highlighted in the <a href="https://www.mandiant.com/m-trends" target="_self">2022 Mandiant M-Trends report</a>, where it was reported that ransomware-related intrusions have a median dwell time of five days compared to 36 days for non-ransomware intrusions.</p><p>What does this mean for defenders?</p><p>As ransomware gets faster, with the goal of quickly compromising the network and exfiltrating data, we can no longer ignore macOS. And with macOS-focused malware on the rise we predict a major successful ransomware attack in the near-term future.</p><p>Below, we highlight how and why it is necessary to plan for a future of increased attacks on macOS.</p><h2>The rise of macOS in the enterprise</h2><p>Perhaps the biggest reason to be concerned about a rise in attacks on macOS has to do with its increased adoption in the enterprise. Spurred by the pandemic and the move to remote work, <a href="https://www.computerworld.com/article/3644494/2021-the-year-apple-became-a-big-player-in-enterprise-tech.html" target="_self">Apple became a Big Player in Enterprise Tech</a> this past year — and a bigger footprint equals a larger attack surface.</p><p>Mobile device management vendor <a href="https://blog.kandji.io/hybrid-workforce-boosts-apple-adoption-in-the-enterprise-survey-finds" target="_self">Kandji</a> conducted a survey in 2021 that showed Apple device use had grown 76% over the past two years. Gartner reported that Mac shipments were up slightly in Q1 2022 as compared to a decline in overall PC shipments. And IDC numbers in 2021 show growth in enterprise adoption as well.</p><blockquote class="ml-3 pl-3 border-l">"Growth in Mac usage among business users, especially for employees working remotely and given their choice of PC device, is pushing more businesses to formally adopt management tools and strategies around macOS, along with iOS/iPadOS and tvOS,” said Phil Hochmuth, program vice president, Enterprise Mobility and Client Endpoint Management, IDC.<div class="quote-reference"><a href="https://www.idc.com/getdoc.jsp?containerId=US46965620" target="_self">IDC MarketScape</a>: Worldwide Unified Endpoint Management Software for Apple Devices 2021 Vendor Assessment</div></blockquote><h2><br/>macOS & ransomware: It’s about the unknowns</h2><p>For known attacks, the <a href="https://en.wikipedia.org/wiki/Gatekeeper_(macOS)" target="_self">MacOS Gatekeeper</a> does a decent job at stopping threats that have already been exposed to the world. It’s the unknown, never-before-seen attacks that are the problem for any platform and operating system. Attackers are evolving their techniques to evade and bypass existing controls, including macOS, and they are succeeding.</p><p>There have been a few notable ransomware attempts on macOS starting with <a href="https://appleinsider.com/articles/16/03/06/malware-infected-transmission-29-app-threatened-os-x-users-stopped-by-xprotect" target="_self">KeRanger</a> in 2016 and <a href="http://appleinsider.com/articles/17/02/22/swift-based-ransomware-targets-macos-pirates-with-false-decryption-promise?mid=1" target="_self">Patcher</a> in 2017. Then, in 2020, ransomware distributed through pirated software, dubbed <a href="https://www.computerweekly.com/news/252485493/Mysterious-EvilQuest-macOS-ransomware-spreads-through-torrents" target="_self">EvilQuest</a>, began actively targeting macOS systems. EvilQuest encrypts victim's files, which some think is just a smokescreen, and installs a <a href="https://www.techtarget.com/searchsecurity/definition/keylogger" target="_self">keylogger</a> and a reverse shell to <a href="https://www.techtarget.com/whatis/definition/command-and-control-server-CC-server" target="_self">a command-and-control (C2) server</a> and can steal any files it finds related to cryptocurrency wallets.</p><p>Ransomware remains a significant concern:</p><ul><li>Ransomware will <a href="https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/" target="_self">cost its victims around $265 billion (USD) annually by 2031</a> as ransomware perpetrators progressively refine their malware payloads and related extortion activities.</li><li>The <a href="https://www.paloaltonetworks.com/company/press/2022/ransomware-payments-hit-new-records-in-2021-as-dark-web-leaks-climbed--according-to-new-report-from-palo-alto-networks-unit-42" target="_self">average ransomware demand increased 144%</a>, while the average payment increased 78%.</li><li>Between January and March of 2022, <a href="https://www.digitalshadows.com/blog-and-research/q1-2022-ransomware-roundup/" target="_self">LockBit 2.0 and Conti were responsible for 58% of all incidents</a> and were the most active ransomware gangs so far this year.</li><li>The <a href="https://www.zdnet.com/article/this-is-how-fast-a-ransomware-attack-encrypts-all-your-files/" target="_self">fastest form of ransomware</a> is <a href="https://www.zdnet.com/article/a-deep-dive-into-the-operations-of-the-lockbit-ransomware-group/" target="_self">LockBit</a>, with a median time of just 5 minutes and 50 seconds to encrypt 100,000 files — and in one test it took only 4 minutes and 9 seconds.</li><li>The <a href="https://www.mandiant.com/m-trends" target="_self">2022 Mandiant M-Trends report</a>, stated that ransomware-related intrusions have a median dwell time of 5 days compared to 36 days for non-ransomware intrusions.</li></ul><p><a href="/blog/ransomware-unpatched-vulnerabilities" target="_self">Unpatched vulnerabilities</a> remain one of the top entry points to infiltrate a network. As attacks continue to grow in sophistication and frequency (a new attack occurs every two seconds) Apple will not be immune. In March 2022, Apple <a href="https://www.intego.com/mac-security-blog/apple-releases-macos-12-3-1-ios-15-4-1-watchos-8-5-1-and-more/" target="_self">patched</a> two “actively exploited” (i.e., in-the-wild, zero-day) security vulnerabilities for macOS Monterey, but the company had not released security updates for previous versions. This leaves "high confidence that CVE-2022-22674 likely affects both macOS Big Sur and macOS Catalina," and "nearly all vulnerabilities in the Intel Graphics Driver" have affected all versions of macOS.</p><p>The phrase “stop it before it does damage” is often used regarding ransomware or other malware. The trouble with this mentality is that the malware is already active inside your environment. Ransomware actors are getting smarter about when they exfiltrate data or encrypt systems to avoid detection by waiting until the final stage of the attack. Once the initial malware is executed, which could be a simple backdoor or a password stealer, the threat actor identifies the infected host as part of an organization's network. The threat actor then moves laterally across the network to deploy ransomware as the secondary attack, more potent than the first.</p><p></p><figure style = "margin: auto; text-align: center;width: auto;"><a href="/pdf/whitepaper-malware-classifiation-in-threat-prevention" target="_blank"><img asset_uid="bltaf83ad4ea35a7eb5" alt="Deep classification breakdown." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaf83ad4ea35a7eb5/627ad19d7198441d81b3f3c7/deep-classification-breakdown.png"/></a><figcaption  style = "text-align: center;" style="text-align: center;">Example of a Deep Classification breakdown.</figcaption></figure><h2><br/>Mac ransomware protection: Deep Instinct’s advanced ransomware protection for macOS</h2><p>Deep Instinct’s prevention-first approach to ransomware and <a href="/zero-day-attacks" target="_self">zero-day threats</a> stops attacks before they can execute on the endpoint, meaning the attackers never get the chance to drop artifacts or exfiltrate your data. With a layered defense, the <a href="/platform" target="_self">Deep Instinct Prevention platform</a> will protect your organization at the endpoint as well as your custom applications from malicious file uploads.</p><p>The Deep Instinct Prevention Platform provides the following:</p><ul><li>Attack prevention in &lt;20ms, faster than the fastest ransomware can encrypt</li><li>False positive rate of &lt;0.1% so your team is only responding to high-fidelity alerts</li><li>&gt;99% unknown threat accuracy that protects your systems from new attacks and variants</li></ul><p>To learn more about how Deep Instinct’s unique deep learning framework provides unmatched prevention for unknown and <a href="/ransomware-protection-solution" target="_self">ransomware attacks</a>, check out this <a href="/videos?wchannelid=ysjgh8jbc8&wmediaid=vtilpp0rly" target="_self">video</a> or contact us for a demonstration.</p><h2>Further Reading</h2><ul><li><a href="/blog/3-reasons-ransomware-rollback-is-not-an-effective-strategy" target="_self">https://www.deepinstinct.com/blog/3-reasons-ransomware-rollback-is-not-an-effective-strategy</a><strong></strong></li><li><a href="/blog/ransomware-unpatched-vulnerabilities" target="_self">https://www.deepinstinct.com/blog/ransomware-unpatched-vulnerabilities</a></li><li><a href="/blog/healthcare-vs-hive-ransomware-how-to-protect-yourself" target="_self">https://www.deepinstinct.com/blog/healthcare-vs-hive-ransomware-how-to-protect-yourself</a></li><li><a href="/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa" target="_self">https://www.deepinstinct.com/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa</a></li><li><a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.105606282.808318644.1651786112-1559688305.1620183151" target="_self">https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.105606282.808318644.1651786112-1559688305.1620183151</a></li></ul><h2>Learn More</h2><p>Watch our on-demand webinar "Ransomware: Are Macs Better Protected Than Windows Machines?" with Karen Crowley, Director, Solutions Marketing and Guest Speaker Miri Peer, Director, Product Management at Deep Instinct.</p><div class="wistia_responsive_padding" style="padding-top: 56.25%;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;position: relative;"><div class="wistia_responsive_wrapper" style="height: 100%;left: 0px;position: absolute;top: 0px;width: 100%;"><span id="popover_preview_embed" class="wistia_embed wistia_async_zk9tpsy8p9 container=popover_preview_embed popover=true popoverAnimateThumbnail=true videoFoam=true" style="display: inline-block;height: 100%;position: relative;width: 100%;">&nbsp;</span></div></div>

Ransomware: Is macOS more protected than Windows?

3 Reasons Why Ransomware Rollback is Not An Effective Strategy blog featured image

blog-3-reasons-rollback.png

<p>“You’re only as good as your last backup” is a phrase all too familiar to any security practitioner or system administrator. Backups have been at the core of disaster recovery plans for as long as they have existed. Whether the issue is a drive that crashes or a ransomware attack, the objective is the same: recover the data and get the organization back on its feet as quickly as possible.</p><p>But as anyone involved in this process can attest – this is easier said than done.</p><p>There is a misconception being touted that if you get hit by a ransomware attack or infected by other malware, and you stop it soon enough, perhaps after “only four files were encrypted,” you can simply rollback to your last known clean backup. Which begs the question: can you rollback without business impact and be assured that you have completely eradicated the threat?</p><h2>What is ransomware rollback remediation and what can go wrong?</h2><p>The concept of “rollback remediation” is an evolution of the classic backup strategy. In this context, organizations use copies of important files stored on the local drive or remote stores to rapidly recover, or “rollback,” unwanted changes. In cybersecurity, those unwanted changes are often the result of ransomware, known or <a href="/glossary/unknown-malware" target="_self">unknown malware</a>, or a fileless or script-based attack.</p><p>Endpoint security solutions often leverage shadow copies and use the Volume Shadow Copy Service (VSS). VSS was introduced by Microsoft in Windows Server 2003 to better manage the backup of running applications – but relying on VSS and shadow copies is problematic in cybersecurity. The problem is that backups take up valuable storage space, so the just-in-time nature of VSS turns into a game of cat-and-mouse where it's a race against time to capture the right snapshots before the ransomware (or other malware) begins to encrypt or compromise your systems. And if your shadow copies are deleted, you are left to restore from your master backup.</p><p>Some security vendors have followed Microsoft’s lead and created their own file restoration utilities to provide a similar service that creates copies of important files as a hedge against an attacker encrypting or destroying them. But this is more of a hedge, not a solution.</p><h2>3 Drawbacks to Ransomware Rollback</h2><p>Why is ransomware rollback not an effective solution? We’ve put together the top 3 reasons why you might want to reconsider rollback as a strategy.</p><h3>Ransomware Rollback Fact #1: The bad guys know about it, too</h3><p>The first challenge with a rollback remediation strategy – ransomware or otherwise – is that threat actors know it’s in your playbook and understand that organizations rely on it to avoid paying a ransom by quickly restoring files to recover from ransomware attacks. Malware authors have leveraged the ‘vssadmin’ command to delete existing shadow copies for years. In fact, it happens so often that MITRE has added the technique to their ATT&CK framework (see Fig. 1 below). In some cases, ransomware has been written to disable VSS and then wait to execute the encryption to make sure any remaining shadow copies are rendered useless. Security researcher Florian Roth <a href="https://twitter.com/cyb3rops/status/1312363071059488768?s=20" target="_blank">released</a> a program called <a href="https://github.com/Neo23x0/Raccine" target="_blank">Raccine</a> (ransomware vaccine), that looks for a process that tries to invoke ‘<em>vssadmin delete shadows</em>’ and kills the entire tree.</p><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8cfe9209c4f29074" alt="Figure 1: MITRE ATT&CK technique for removal of shadow copies" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cfe9209c4f29074/62686e2caacc645ccdba5b98/figure-1-mitre-attack-technique.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 1: MITRE ATT&CK technique for removal of shadow copies</figcaption></figure><p></p><p>There are several other methods by which attackers can delete shadow copies.</p><ul><li>Wmic.exe with command line <em>shadowcopy delete</em></li><li>PowerShell with command line <em>win32_shadowcopy</em></li><li>Vssadmin.exe with command line <em>resize shadowstorage</em></li></ul><p>The most common ransomware families, including WannaCry, REvil, Robbinhood, and Conti remove shadow copies and/or <a href="https://attack.mitre.org/techniques/T1490/" target="_blank">disable file recovery features</a>. The <a href="https://www.ivanti.com/lp/security/reports/ransomware-spotlight-year-end-2021-report" target="_blank">Ransomware Spotlight Year End 2021 Report</a> from Ivanti, (see Fig. 2) shows that 32 new ransomware families appeared in 2021 alone (an increase of 25% over the previous year). Every new ransomware family represents an increased risk to an organization’s security, regardless of their backup or rollback strategy.</p><p></p><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2d5ebd3e33111edc" alt="Figure 2: Ransomware continues its year-over-year rise" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2d5ebd3e33111edc/62683ac40796ef5b6c345715/figure-2-ransomware-rises.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 2: Ransomware continues its year-over-year rise</figcaption></figure><p></p><p>The recent and highly successful <a href="/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa" target="_self">REvil ransomware campaign</a> demonstrated this technique as it proliferated after compromising the Kaseya software distribution platform. As many as 1,500 organizations were affected by this campaign as REvil demanded a whopping $70 million ransom from Kaseya. And as previously mentioned, REvil relies on a mechanism to delete shadow copies, as do most ransomware families.</p><h3>Ransomware Rollback Fact #2: Restoring files may get you back in business, but the threat remains</h3><p>Killing the ransomware or other threat in progress and immediately restoring the damaged files is not a best practice. If you use rollback you may succeed in getting back to business with minimal downtime, but do you know if a backdoor was installed? And can you be sure you have eradicated the entire threat? Ransomware malware is not always how an attack is executed. Malware can contain a number of different suspicious threats beyond ransomware such as backdoors, potentially unwanted applications (PUA), and spyware, just to name a few. Any of those threats can be the entry point for ransomware, which is why malware <a href="/pdf/whitepaper-malware-classifiation-in-threat-prevention" target="_self">classification is critical to know what it is the attacker is installing</a>.</p><p>The prevalence of hybrid attacks that exfiltrate files for extortion before encrypting them brings this issue into sharp relief – just when you think the threat attackers are gone, can you be sure they won’t come back for more?</p><p>In the case of ransomware, file encryption is just the obvious final step for an attacker who’s already loose inside the environment. Once an attacker has successfully exerted control over an endpoint, there are many other actions they may have taken – and none of them are good.</p><p>When you look at an organization’s policies, nearly every incident response plan starts with “contain the breach,” not “restore the files.” Contain the breach means quickly identifying the attack, understanding its blast radius, and stopping its spread. If you roll back too soon you lose the opportunity to remove the entire threat and understand what else could possibly be affected. Establishing the timeline of point of entry is a critical step.</p><p>Once threat actors gain access to environment, a common attack strategy is to “break” the backup process while leaving the illusion that is still functioning properly. At times, attackers may wait 7 to 21 days to execute the attack or encrypt the files. This means that after a threat has been detected, organizations may have to go back days, weeks, or even months to restore systems back to their pre-infection state. The time to restore is measured in days, weeks, and months because servers, databases, and VMs must be rebuilt.</p><p>NIST’s <a href="https://us-cert.cisa.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_Document-FINAL.pdf" target="_blank">incident response guidance</a> for a ransomware attack is clear – containing the entire attack is the first step. Securing backups to prevent corruption is another important early step. Restoring from those backups should only happen after the environment is no longer infected. The reality is that if the attacker still has a foothold, there is nothing stopping them from encrypting again and the next time, they will make sure they kill off the backups.</p><h3>Ransomware Rollback Fact #3: Ransomware is not the only threat to rollback</h3><p>When it comes to relying on rollback for remediation, ransomware deleting shadow copies is not the only threat that you need to be concerned with. Newer attacks are corrupting backups or changing the encryption keys of the backup to something unrecoverable. And organizations would be unaware this is taking place unless they performed a backup restoration test, which is rare. Recent attacks include fileless malware and script-based attacks, which are even more difficult to identify and stop because they don’t insert malicious code onto the endpoint, but instead rely on built-in utilities of the system itself.</p><p>Specifically, PowerShell and Windows Management Instrumentations (WMI) are two key targets for this type of attack because of their increased privileges on the system. With these toolkits at their fingertips, attackers can easily delete shadow copies, shutdown critical system services, and establish persistence – all without triggering standard anti-virus programs. As mentioned previously, threat actors have been known to make it appear that backups are still up and running, making the job of detecting them even harder.</p><h2>Preventing the attack avoids messy rollback scenarios</h2><p>By preventing malware, including ransomware, before it can execute and infect a system, the entire attack chain is broken before it can even begin. Since the malware never launches, it can’t exfiltrate files for future extortion, encrypt files, or take other destructive actions. There is no need to rollback or restore because the system wasn’t infected in the first place.</p><p>Traditional EDR solutions are reactive and look for behaviors post-execution, providing attackers with the time they need to begin to breach your environment. Threat actors are constantly developing new attacks that evade detection, and <a href="/endpoint-detection-response" target="_self">EDR is not enough</a> to stop attacks. For more information, check out the <strong>8 Reasons EDR is Not Enough</strong> <a href="/pdf/infographic-8-reasons-why-edr-is-not-enough" target="_self">infographic</a> and <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough?_ga=2.132178824.724064347.1650899812-1559688305.1620183151" target="_blank">eBook</a>.</p><p>When an attack is prevented pre-execution, your organization avoids the downstream costs of an active threat, meaning the threat actor never gets inside to disable your backups. While backups are still a vital piece of the security stack, it is far better to prevent an attack before any damage can be done to an organization's systems and data than to rely on a rollback strategy.</p><p>Deep Instinct takes a <a href="/video/prevention-starts-with-deep-instinct" target="_self">prevention-first approach</a> to stopping ransomware, zero-day vulnerabilities, and other unknown malware pre-execution, reducing your reliance on flawed strategies like rollback. With innovative technology based on the only deep learning framework for cybersecurity, Deep Instinct can prevent &gt;99% of attacks pre-execution, lowering your false positive rate to &lt;0.1% and reducing your overall risk.</p><h2>Sources</h2><ul><li><span style="color: rgb(29, 28, 29);"><strong>docs.microsoft.com</strong><strong><br/></strong></span><a href="https://docs.microsoft.com/en-us/answers/questions/46408/volume-shadow-copy-service-deleted-after-ransomwar.html" target="_self">Volume Shadow Copy Service deleted after ransomware attack - Backup no longer working - Microsoft Q&A<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">“Earlier this week the server was compromised by a ransomware attack. When I logged into the server the next day the shadow copies were all gone and also the windows server backup was not working anymore.”<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>csoonline.com</strong><strong><br/></strong></span><a href="https://www.csoonline.com/article/3331981/how-to-protect-backups-from-ransomware.amp.html" target="_self">How to protect backups from ransomware | CSO Online<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">Ransomware is getting smarter, attacking backups to prevent recovery. Prevent this from happening by taking a few simple steps.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>Born's Tech and Windows World</strong><strong><br/></strong></span><a href="https://borncity.com/win/2020/10/07/raccine-protect-volume-shadow-copies-from-ransomware/" target="_self">Raccine: Protect volume shadow copies from ransomware<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">[English]Interesting story - a security researcher has developed a tool called Raccine as a simple protection against ransomware. This should prevent ransomware or other malware from deleting the volume shadow copies on Windows NTFS drives. Ransomware deletes VSS copies when a Windows system is infected.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>redcanary.com</strong><strong><br/></strong></span><a href="https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/" target="_self">It’s all fun and games until ransomware deletes the shadow copies<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">A malicious batch (.bat) file executed a PowerShell command that downloaded and executed a remotely hosted payload on Pastebin to deploy ransomware. Additionally, it launched the Volume Shadow Service Administration Tool (vssadmin.exe) to remove local shadow copies.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>pkware.com</strong><strong><br/></strong></span><a href="https://www.pkware.com/blog/ransomware-plus-exfiltration-encrypt-your-data-before-someone-else-does" target="_self">Ransomware Plus Exfiltration: Encrypt Your Data Before Someone Else Does<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">Starting in late 2019, a hybrid variety of cyberattack has emerged, in which traditional ransomware tactics are combined with data exfiltration.<br/></span></li><li><strong>Evading EDR</strong><strong><br/></strong><a href="https://vanmieghem.io/blueprint-for-evading-edr-in-2022/" target="_self">https://vanmieghem.io/blueprint-for-evading-edr-in-2022/</a></li></ul>

3 Reasons Why Ransomware Rollback is Not An Effective Strategy

8-reasons-edr-is-not-enough.png

<p><a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">Endpoint Detection and Response (EDR) tools</a> have risen in popularity based on the belief they can stop and remediate most of the cybersecurity threats organizations face daily. But mounting evidence is painting a very different picture of EDR’s efficacy and protection abilities. During the same period EDR has become a mainstay of modern security postures, attacks have skyrocketed in frequency, severity, and success.</p><p>The threat landscape is getting demonstrably more hazardous. Between 2019 and 2020 we saw an <a href="https://solutionsreview.com/endpoint-security/deep-instinct-releases-2021-mid-year-threat-landscape-report/" target="_self">800% increase in ransomware attacks</a> and Ponemon Research has indicated that <a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_self">80% of successful breaches</a> come from previously unknown malware and zero-day attacks. The tools that many organizations are using are not providing adequate protection from increasingly sophisticated attacks.</p><p>And if EDR tools alone were the answer to preventing ransomware and zero-day threats we would see attacks trending downward. Instead, despite billions in spending, we’re seeing them consistently rise.</p><p><a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_blank">Read the eBook</a>: 8 Reasons Why EDR is not Enough to learn why EDR tools are not the answer to defending against advanced attacks.</p><ol><li>“Assume Breach” mentality is flawed</li><li>EDR is a reactive approach</li><li>EDR is not winning against ransomware</li><li>EDRs produce high false positives</li><li>ML weaknesses lower EDR’s efficacy – and can be exploited</li><li>EDR is only as good as its visibility across every endpoint</li><li>EDR blocks post-execution, it doesn’t prevent pre-execution</li><li>XDR only makes EDR less effective</li></ol><h5>Re-thinking Cyber Defense</h5><p>EDR is based on an “assume breach” mentality – the long-held conventional thinking that no cyber defense can truly prevent cyber criminals from entering an environment. Detection and Response solutions like, EDR, MDR, NDR and XDR all have one thing in common – they are all based on post-execution remediation. By its very name, EDR is only relevant once the attack has taken place. And this ultimately means that the attackers are inside your network and you can’t be sure you stopped the full context of the attack.</p><p>Post-execution is too late to prevent a breach and remediation is costly and time consuming – a point driven home by <a href="https://www.scmagazine.com/news/edr-alone-wont-protect-your-organization-from-advanced-hacking-groups" target="_self">recent research</a> testing the efficacy of 11 of the best-known EDR tools highlighting their inherent shortcomings. The growing sophistication of modern threats and the high number of successful breaches has proven that EDR is not enough to stop today’s increasingly advanced threats.</p><p>It’s time to redefine what threat prevention truly is and explore new technology based on deep learning that has made <a href="/glossary/malware-detection" target="_self">malware detection</a>, classification, and prevention possible.</p><h5>Stop Responding. Start Preventing.</h5><p>Security teams recognize that their security capabilities are not protecting them from today’s most advanced threats and are actively investing in greater protection. <a href="https://www.gartner.com/en/newsroom/press-releases/2021-05-17-gartner-forecasts-worldwide-security-and-risk-managem" target="_self">Gartner</a> forecasts that global security and risk management spending would exceed $150 billion in 2021. It likely surpassed that.</p><p>A prevention-first approach to stopping threats will complement or replace existing EDR solutions to mitigate risk. Preventing malware pre-execution and lowering false positives will improve operations, lower costs, and stop known, unknown, and zero-day threats, including ransomware, before they get the chance to infect your environment.</p><p>Download our latest eBook, <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_blank">8 Reasons Why EDR is Not Enough</a>, to understand why fresh thinking around EDR tools is overdue. And why deep learning-based cybersecurity holds the promise of true prevention, stopping &gt;99% of threats and significantly lowering false positive alerts to &lt;0.1%.</p><p></p>

8 Reasons Why EDR is Not Enough

Speed-Prevention.png

<p>Stopping never-before-seen malware is a race against the clock. In just 15 seconds the fastest known ransomware begins to encrypt. By contrast, the quickest <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">endpoint detection and response </a>(EDR) solutions take at least a few minutes to detect a threat — with many taking hours or even longer. In fact, in the time it took you to read this paragraph it would be too late.</p><p>In a matter of minutes, extremely destructive ransomware has ample time to lock down patient zero, install backdoors, and begin moving laterally through the network. And it’s highly likely that by the time the security team is aware of a problem, data will have been exfiltrated and the majority of the network impacted.</p><p>The challenge is that most security tools begin their work only after malware has started executing – behaviors are then analyzed to identify the type of attack. This approach not only provides the attackers with ample dwell time, it frequently leads to a high number of false-positive alerts, leaving SOC teams to determine what is a real threat versus a benign alert. The focus after detection is then&nbsp;on understanding what happened, conducting further investigation, remediation, and clean-up – a time intensive and expensive process.</p><p>A deep learning-based approach provides an opportunity to prevent threats much earlier and stop attacks before they infiltrate your environment, vastly reducing overall risk.</p><h2>Why 20 Milliseconds Matters</h2><p>Speed matters. Today's attacks are lightning fast and the stakes are higher than ever.</p><p>Yet, in Deep Instinct’s <a href="https://info.deepinstinct.com/tof/voice-of-secops-2021" target="_self">Voice of SecOps report </a>released last week, one key finding is that it takes 20+ hours for an organization to respond to a cyber incident. There is a better way.</p><p>Deep Instinct makes exceptionally fast and accurate malicious versus benign decisions using its patented deep learning technology. This means that <a href="https://www.deepinstinct.com/pdf/di-product-infographic" target="_self">threats are blocked in &lt;20 milliseconds</a>; 750x faster than ransomware is known to encrypt. This stops malware in its’ tracks; preventing droppers, artifacts, and backdoors from being installed on the network. By preventing attacks before they execute, Deep Instinct ensures your organization does not become front page news.</p><p>For enterprises, this means greater SOC effectiveness, as well as&nbsp;the following:</p><ul><li>Dedicated time gained back for proactive threat hunting</li><li>Increased efficiency and reduced downstream impact on EDR by correlating prevented and high-fidelity events</li><li>Improved security hygiene to focus on strategic tasks like patching, decommissioning, and hardening systems</li></ul><h2>The Next Stage in Our Commitment to Constant Innovation: Version 3.2</h2><p>With the latest release of the <a href="https://www.deepinstinct.com/platform" target="_self">Deep Instinct Prevention Platform </a>(Version 3.2) we introduced several powerful new features that can detect and prevent some of the most dangerous, fast-moving malware threats to help customers stay ahead of the game.&nbsp;</p><h2>Prevention Against Reflective DLL Injection</h2><p><a href="/glossary/fileless-malware-definition" target="_self">Fileless malware</a> that loads dynamically, directly from memory, is a serious threat that can circumvent most security solutions and then launch multi-stage attacks. <a href="https://www.deepinstinct.com/blog/emotet-malware-2020" target="_self">Emotet</a> is one of the premier examples of <a href="https://www.deepinstinct.com/blog/malware-evasion-techniques-part-1-process-injection-and-manipulation" target="_self">reflective DLL</a>, as the infamous malware botnet serves as a loader that downloads additional malware like TrickBot (an extremely damaging reconnaissance and ransomware combination which uses static injection). Emotet and other similar malware strains are designed to be as evasive as possible and continually evolve to avoid detection and maximize dwell time.</p><p>With its <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">fileless malware protection</a>, Deep Instinct prevents malicious DLLs from loading from memory, not just from disk, ensuring attacks are stopped from executing on the network, shutting down this critical attack vector.&nbsp;</p><p>We also prevent&nbsp;reflective .NET injection protection, another new heuristic for Windows devices, using the same principle. Deep Instinct detects and prevents .NET executables being loaded into processes from memory space.&nbsp;</p><h2>Anti-AMSI Bypass</h2><p>We have also&nbsp;added anti-AMSI bypass protection. The Windows Anti-Malware Scan Interface (AMSI) is a standard that allows applications and services to integrate with any anti-malware product present on a machine. AMSI is designed to help security teams deal with attacks that use obfuscation and encryption to avoid detection, <a href="https://www.deepinstinct.com/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions" target="_self">such as those abusing PowerShell</a>. However, malware developers have created <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">fileless attacks </a>that can bypass AMSI, as well as living-of-the-land techniques that exploit native Windows applications. Our new heuristic provides protection against attempts to bypass Microsoft’s AMSI on Windows devices.&nbsp;</p><h2>Deep Instinct Prevention Platform. Meet Attackers Earlier.</h2><p>The Deep Instinct Prevention Platform is powered by the world’s first and only purpose-built <a href="https://www.deepinstinct.com/why-deep-instinct" target="_self">deep learning cybersecurity framework</a>. The technology is based on a deep neural network that mimics the learning and logical capabilities of the human brain. Deep Instinct’s static analysis engine prevents &gt;99% of known and unknown malware, <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day threats</a>, and ransomware, for <a href="https://www.deepinstinct.com/endpoint-security" target="_self">endpoints </a>and <a href="https://www.deepinstinct.com/beyond-the-endpoint" target="_self">beyond</a>.</p><ul><li><strong>Deep Instinct for Endpoint</strong>, the company's flagship offering, provides additional dynamic analysis layers beyond static analysis, including behavioral and reputational, to prevent the most advanced malware and multi-stage attacks. Deep Instinct for Endpoint protects against fileless attacks such as malicious code injection, in-memory, and shellcode scripts, as well as extremely advanced attacks like Adversarial AI.</li></ul><ul><li><strong>Deep Instinct for Cloud</strong> stops malicious files from uploading to, or downloading from, public or private cloud storage, including AWS S3, Azure Blob, and Google Cloud Storage.</li></ul><ul><li><strong>Deep Instinct for Applications</strong> scans the files associated with custom applications and workflows to prevent infected files from being uploaded to, or downloaded from, their end-users or customers.</li></ul><ul><li><strong>Deep Instinct for Web Gateways</strong> protects organizations by preventing malicious files from downloading onto the network by end users who are browsing the internet.</li></ul><p>All prevented events are enhanced with contextual data including the malware’s classification and are mapped to the MITRE ATT&CK framework. The Deep Instinct Prevention Platform is designed to be incorporated into an organization’s existing security stack and tightly integrate with solutions like EDR, SOAR, and SIEM. Deep Instinct works seamlessly with existing security processes to lower risk and improve an organization’s overall security posture.</p><p>Deep Instinct’s &lt;20ms time to prevention combined with our &lt;0.1% false-positive guarantee allows our customers to prevent known and<a href="/glossary/unknown-malware" target="_self"> unknown malware</a> – before systems are infected. This means that SOC teams can focus on tasks that improve productivity and spend more time threat hunting to stop the most complex, sophisticated, and aggressive attacks.</p><p>We’re extremely proud to introduce this new and improved version of the Deep Instinct Prevention Platform and would be thrilled to <a href="https://www.deepinstinct.com/request-a-demo" target="_self">give you a demo</a>.</p>

Why 20 Milliseconds Matters in Cybersecurity

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)