Detection Mechanism ①: Correlation Detection Rule

A rule library of over 400 correlation detection rules for monitoring various data sources. Detection rules are designed as a set of rules for detecting "attacker techniques" defined by MITER ATT&CK ^*2, making it possible to detect sophisticated attacker techniques and behaviors.

For example, a rule that detects from authentication logs the brute force ^*3 behavior often used by attackers to elevate privileges (taking Active Directory administrator privileges, etc.) after intrusion, and lateral movement within the target company by attackers. Over 400 rule libraries are available, such as rules for detecting abuse of remote services (SMB ^*4, RDP ^*5, etc.) that are frequently used when planning for security.

*2: The flow and methods of cyberattacks have been systematized by MITER (USA), a not-for-profit organization that implements CVE numbering.
©2020 The MITER Corporation.

*3: One of the methods of deciphering passwords by "brute force attack".

*4: Abbreviation for Server Message Block. A protocol (communication protocol) and communication service for sharing files and printers among multiple Windows computers on a local network (LAN)

*5: Abbreviation for Remote Desktop Protocol.

Detection Mechanism ②: Threat Intelligence

In conjunction with our own threat intelligence service, it is possible to detect suspicious behavior and communications as early as possible from the latest IoC (Indicator of Compromise) ^*1. It works in conjunction with an intelligence service that integrates over 30 threat intelligence feeds, integrates IoC into SIEM, and performs various detections by matching with IoC.

For example, based on IoC, we have prepared a number of searches that detect accesses to domains frequently used by attackers and communications to IPs that are recognized as C&C servers. This makes it possible to apply the latest threat intelligence that integrates information from around the world to SIEM operations and improve the level of security response.