【Incident Response Case】 When personal information is breached and exploited by hackers, how do enterprises deal with it?

Challenges

If a personal information breach is discovered, we will quickly assist in handling it.

• Interpret alarm information and determine possible causes

• Provide response suggestions to control the spread of incidents

• Collection of key evidence, investigation analysis and planning

Endpoint detection and analysis to understand the scope of attacks

• Key forensic analysis: Based on the circumstances of the case, the TeamT5 team identified the host that may be the key incident, and used professional tools to conduct forensic analysis and network equipment communication records at the time of the incident for further investigation into incident correlation.
• Comprehensive scan of endpoints and list of compromised areas: ThreatSonar quickly scanned the security of hosts in the site and found that the host involved had high-risk (Level 5) threats. It analyzed the malicious threats that hit the APT detection rules, abnormal login events, suspicious file paths, and malicious relay station (C2) list and other threat information. ; Another host was detected to have malicious behaviors such as lateral movement and attackers using remote desktop services.

Investigate the root cause of the incident and visualize the attack trajectory

• Incident investigation and analysis: It was found that weak passwords (weak passwords) that are easily cracked were exploited on the website management page. Webshell was detected on the website. After inspection, it was found that the hacker uploaded the malicious web program to the target server through a vulnerability of file upload. At the same time, it was discovered that there was a leakage of relevant file information on the official website.
• Field evidence correlation: From the host event log, it was discovered that there were subsequent behaviors such as Powershell and lateral movement, and the accounts that may have been controlled and used were summarized, as well as the attack source IP information.
• Comprehensive investigation results: Through the visual summary of event trajectories, clients can understand the attack path of the incident and clearly understand how the attacker exploited the website's weaknesses and accessed the website's backend through different IPs, and then obtained a privileged account to have lateral movement.

Block the source of the attack and restore the incident environment

• Confirm whether the security status of field endpoints is clean Through the endpoint security scanner, first confirm whether the endpoints in the field have malicious threatening behaviors, such as backdoors, hacking tools, lateral movement, etc., and then scan and confirm with anti-virus software, and then allow the endpoints to access the Internet one by one.
• Review whether network access rules are strict Check the rules for network management and general users in the domain to access the service host to prevent all hosts from being able to remotely log in to the service host, such as RDP, WinRM, SMB, Anydesk, etc., and block the risk of lateral movement of attackers.
• Confirm whether the system account permissions are appropriate For the exploited account, if it is not a known account, it must be deactivated immediately and the account creation time must be confirmed; in addition, if AD has been implanted with a backdoor or lateral movement, the domain administrator and user passwords must be changed immediately, Evaluate whether to rebuild AD.
• Confirm whether system vulnerabilities can be controlled Analyze and investigate system records such as websites, APs, and DBs to confirm whether there are malicious sources and behaviors, block the discovered malicious sources, and repair possible vulnerabilities. Analyze and investigate the connection source of the firewall and account usage, confirm the device status and update the version. You must ensure that the device is safe before going online for service.

Review Cybersecurity strategies and strengthen future defenses

• Understand the configuration and operation of system endpoints in the field.
• Strengthen backend management accounts and restrict access sources.
• Control data access sources and restrict the use of dangerous pre-stored programs.
• Systems with files upload function need to have a malicious file detection and prevention mechanism.

• Import endpoint scanning and monitoring mechanism to provide real-time alerts and block malicious behaviors.
• Strengthen network behavior monitoring and system service record backup and analysis mechanisms.
• Establish a threat information output mechanism to detect suspicious threat sources and field weaknesses early.

• For the types of high-risk incidents that may occur (such as ransomware, personal data theft, APT intrusion, etc.), follow the NIST Incident Response Plan to establish an IR Playbook and formulate incident handling procedures (including pre-incident monitoring and analysis, mitigation and elimination during the incident, and post-incident recovery improvement, etc.) so that you can follow the instructions when an incident occurs.

Reference