Expert analysts investigate suspicious files and assist CSIRTs in responding to incidents

CSIRT (Ciesart: Computer Security Incident Response Team) receives suspicious traces (files, communications, operation logs) discovered during detection and work of security products in operation, contacts from external organizations, etc., and responds to incidents. We will investigate and respond. However, CSIRT resources are limited and it is necessary to triage (prioritize) each incident and respond.

In this service, expert analysts investigate suspicious files, report their degree of danger and traces of infection, and assist CSIRT in responding to incidents.

• case 1
  I want to investigate what a file detected by a security product looks like. Ransomware aimed at stealing money, is it a distributed type like Emotet, or is it a targeted attack aimed at intellectual property?
• case 2
  The user may have executed a suspicious file attached to an email, and I would like to know the infection traces (communication destination, etc.) for investigation.

In this service, targeted attacks are judged by professional analysts who specialize in analyzing targeted attacks targeting Japanese companies. We support CSIRTs by utilizing our knowledge of threats with little information from overseas vendors.

Characteristics of targeted attacks and countermeasures

Targeted attacker groups have clear intentions and goals against specific individuals and organizations, and carry out persistent and long-term attacks. Therefore, it is important to quickly determine whether it is a targeted attack and take appropriate measures. In addition, it is important to proactively investigate and determine the possibility of a targeted attack, even if it could be prevented by security products and people's awareness.

Examples) Detection of attack emails written in natural Japanese, discovery of credential dump tools, detection of backdoor malware on servers, etc.

In the case of a targeted attack, even if the attack is blocked, another method will be used to persistently attempt to infiltrate the system. Threat hunting to investigate whether it is not is also effective.

Service features

This service has the following three menus.