You Bet Your Lsass: Hunting LSASS Access

One of the most commonly used techniques is to dump credentials after gaining initial access. Adversaries will use one of many ways, but most commonly Mimikatz is used. Whether it be with PowerShell Invoke-Mimikatz, Cobalt Strike’s Mimikatz implementation, or a custom version. All of these methods have a commonality: targeting LSASS.

How to Secure Deployments in Kubernetes?

Security is crucial ‌for containerized applications that run on a shared infrastructure. With more and more organizations moving their container workloads to Kubernetes, K8s has become the go-to platform for container orchestration. And with this trend comes a growing number of ‌threats and new ways of attack that necessitate strengthening all layers of security. In Kubernetes, there are two aspects to security: cluster security and application security.

What are the top tasks ready for automation, according to security analysts?

What's frustrating security analysts on a daily basis? When we asked that question in our recently published 'Voice of the SOC Analyst' survey, the number one answer was "spending time on manual work" like reporting, monitoring, and detection. Why would that frustrate them? Manual tasks are repetitive, mundane, and tedious, and force analysts to spend most of their day or week chasing down answers or following up on alerts, only to do it again the next day.

Moving from reactive to proactive through automation

Analysts are being weighed down by mundane, tedious tasks, preventing them from doing their best work, causing burnout, and leading them to the point of wanting to leave their jobs. SOC analysts' biggest frustration and one of their top challenges is having to spend time on manual tasks, according to our recent report, 'The Voice of the Analyst.' These tasks are not only repetitive, but they're taking them away from more engaging, higher-impact work.