Name: November 2023 TRU Intelligence Briefing
Start: 2023-11-16T14:28:00Z
End: 2023-11-16T14:28:41.000Z
Location: BrightTALK
Rating: 5

eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks.  
For more information, visit www.esentire.com and follow @eSentire

In this webinar, Kurtis Armour, VP, Product Management at eSentire, Julian Mihai, CISO at Penn Medicine, and Dustin Sachs, Chief Technologist and Sr. Director of Programs at CyberRisk Collaborative, discuss endpoint security trends and strategic guidance for late 2024 and early 2025.

Improving Your Endpoint Security: Forecast and Guidance for Late 2024 and Early 2025

In this webinar Nickolas Davie, Sr. Solutions Architect, eSentire discusses:
- The evolution of Managed Detection and Response (MDR) and its transformative impact within a cohesive tech ecosystem.
- How eSentire exceeds 2nd gen buyer expectations.
- How eSentire owns the “R” in MDR with our all-in-one service with response & remediation you can trust
- The power of eSentire’s 24/7 Security Operations Center (SOC), Threat Response Unit (TRU) and Insight Portal experience. 
- Recommendations and questions to ask when evaluating MDR providers.

Choosing the Right MDR Provider: What You Need To Know

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required.

Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the October Threat Intelligence Briefing, TRU will review:
- Abuse of Remote Monitoring and Management (RMM) by State-Sponsored and Cyber Criminal Groups: A discussion of the most common RMM applications/methods abused by these groups and associated recommendations on how to lock down approved tools and detect/block the rest.
- Tactical Threat Response – RMM Tools: Recommendations for how defenders can detect and prevent RMM abuse.
- Updates on InvisibleFerret, CleanUpLoader, and StealC.
- Notable vulnerabilities impacting Ivanti, Sonicwall, and Zimbra.
- A brief update on cyber activity relating to ongoing North Korean APT activity.

October 2024 TRU Intelligence Briefing

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required.

Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the September Threat Intelligence Briefing, TRU will review:
- Unpacking Trends Around Windows Installer Packages: An analysis of recent trends observed among our customers and the broader threat landscape, focusing on the misuse of Windows installer packages for malware infections. This discussion will cover MSI, MISX, and Inno Setup packages, how they are abused, recommendations for analysis, and the underground services fueling this trend.
- Tactical Threat Response – App Installer Abuse: An overview of how threat actors utilize application installers to distribute malware, along with best practices for mitigating these risks.
- Updates on Poseidon Stealer, Go Injector, and Play Ransomware.
- Notable vulnerabilities impacting Versa, SolarWinds, and Apache.
- A brief update on cyber activity relating to ongoing geopolitical tensions.

September 2024 TRU Intelligence Briefing

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required.

Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the August Threat Intelligence Briefing, TRU will review:
- ChromeLoader - Annoyance or Threat?: An analysis of a pervasive malicious browser extension distributed through deceptive ads and applications, and a discussion of its infection schemes, functionality, and the risks it poses.
- Tactical Threat Response - New ChromeLoader Observations: Overview of recent ChromeLoader observations, highlighting new intrusions and best practices for mitigating the threat.
- Updates on Gh0st RAT, EMPTYSPACE, and AsyncRAT.
- Notable vulnerabilities impacting ServiceNow, Windows, and VMware.
- A brief update on cyber activity relating to ongoing geopolitical tensions; specifically, Russian disinformation campaigns.

August 2024 TRU Intelligence Briefing

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required. 

Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the July Threat Intelligence Briefing, TRU reviewed:
- Navigating Gen AI - Risk Strategy: An analysis of cyber threats stemming from the rapid adoption of AI, and associated eSentire recommendations, including prioritizing risks.
- Valid Account Abuse – Tactical Threat Response: Overview of the valid account initial access vector and recommendations/best practices for defending against this threat.
- Updates on Mantanbuchus, Latrodectus and More_Eggs.
- Notable vulnerabilities impacting MOVEit, PHP, and OpenSSH.
A brief update on cyber activity related to ongoing geopolitical tensions.

July 2024 TRU Intelligence Briefing

As cyber threats become more complex, maximizing your Microsoft E5 investment is crucial for enhancing your organization’s security posture.

Microsoft E5 provides a powerful combination of advanced security features that safeguard your data and infrastructure, facilitating not just compliance but proactive defense. Optimizing your use of Microsoft E5 ensures that you capitalize on these sophisticated security tools to protect your assets and maintain cyber resilience.

In this session, Kurtis Armour, VP, Product, eSentire, and Nickolas Davie, Sr. Solutions Architect, eSentire delve into how organizations can fully leverage the value of their Microsoft Investment.

Key areas of discussion include: 
- Why organizations are making an investment in Microsoft E5 and the comprehensive benefits of this licensing option.
- How eSentire classifies alerts and detections that come out of these platforms, including examples of intrusion-type events in Microsoft Defender for Endpoint and Defender for Identity.
- Understanding the Total Cost of Ownership benefits including how organizations can significantly reduce overall security spend without sacrificing quality. 
- The importance of considering a supported investment in multi-signal Managed Detection and Response (MDR) to operationalize Microsoft capabilities and enhance an organization's security posture.

Maximize Your Microsoft With 24/7 MDR

According to research conducted by Cyber Security Hub, 40% of cybersecurity professionals saw a rise in the frequency and intensity of cyberattacks faced by their organisations over the last year.

With threat actors constantly refining their tactics, techniques, and procedures (TTPs) to target organisations, it is crucial to establish high-quality detection mechanisms to enhance cyber resilience. However, many organisations lack the necessary in-house resources and expertise to detect and contain cyber threats. 

In this webinar Phil Skelton, Sr. Director - International, eSentire discussed:
- The current state of the cybersecurity industry and the latest threats eSentire has detected and stopped.
- How to assess your cyber resilience and build a strong threat hunting program at your organisation
- How you can adopt the right mix of products and services that enable your teams to do more with less.

How to build cyber resilience and secure your organization with limited resources

Watch this on-demand webinar featuring a user group discussion for IT/Security leaders in the legal space. Hosted by Andrew DeBratto, CIO at Hunton Andrews Kurth LLP and Ryan Westman, Director, Threat Intelligence at eSentire, this session sheds light on the latest threats we are seeing targeting our legal customers and digs into the cybersecurity strategy considerations security leaders at legal firms face.

How Much Is Too Much Security

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required. Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the June TRU Intelligence Briefing, our Threat Response Unit (TRU) reviewed:
- Decoding Russian APT Group, FIN7: A review of the most recent infection cases observed by eSentire, including those currently active in the wild, and recommendations on how to protect your organization against these threats.
- Tactical Threat Response – FIN7: Overview of eSentire detection coverage, internal observations, and best practices as they relate to FIN7.
- Updates on Vidar, SolarMarker, and SocGholish.
- Notable vulnerabilities impacting Fluent Bit, Check Point, and Fortinet. 
- A brief update on cyber activity in North Korea.

June 2024 TRU Intelligence Briefing

Watch this webinar to learn about the crucial role of exposure management in enhancing cyber resilience and gain actionable recommendations to manage the intricate dynamics of cyber resilience.

The discussion covers a range of topics, including defining exposure management in relation to vulnerability management, the importance of incorporating exposure management into broader cyber resilience strategies, and the collaborative efforts between eSentire and Tenable to strengthen customers' exposure management strategies.

Exposure Management: How Organizations Can Use It to Build Cyber Resilience

eSentire’s Threat Response Unit (TRU) is a team of industry-renowned experts with real-world experience who are battle-tested to protect you against the most advanced cyber threats.

TRU is foundational to our Managed Detection and Response (MDR) service – no add-ons or additional cost required. Every month, TRU hosts a live webinar to share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the May TRU Intelligence Briefing, our Threat Response Unit (TRU) reviewed:
- Authentication Method Downgrade Attacks: eSentire TRU Researchers discuss how threat actors bypass passwordless authentication methods in real-world attacks.
- Palo Alto Vulnerability (CVE-2024-3400): eSentire observations and new detections from eSentire’s Tactical Threat Response (TTR) team.
- Updates on FIN7, D3F@ck Loader, and SocGholish
- Notable vulnerabilities impacting Palo Alto, Cisco, and CrushFTP
- A brief geopolitical update focused on Russian Information Operations.

May 2024 TRU Intelligence Briefing

In this Manufacturing Cybersecurity Threat Summit hosted by the Manufacturers Alliance, Spence Hutchinson, a Staff Threat Intelligence Researcher at eSentire, along with Tia Hopkins, the Chief Cyber Resilience Officer & Field CTO at eSentire, and Ray Texter, the Chief of Information Security at Texas United Management, explore findings from eSentire's Threat Response Unit (TRU) and delve into the key cyber threats and cybersecurity challenges impacting the manufacturing sector.

Manufacturing Threat Summit: Navigating Threats and Reducing Cyber Risk

In this webinar, Derek Thomas, Director, Tactical Threat Response at eSentire will discuss: 
- Why operationalizing threat hunting is important to create a systematic and proactive approach to threat detection and response.
- How the outcomes of each phase of the “Global Threat Framework” supports the Detect and Respond functions, and how our Threat Response Unit (TRU) puts them into practice for proactive threat hunting and 24/7 threat detection and response.
- Challenges in implementing a Threat Detection and Response program, including expertise, visibility, and response.
- Recommendations on how your organization can leverage proactive threat hunting and multi-signal Managed Detection and Response (MDR) to improve your ability to detect and respond to cyber threats.

Reactive to Proactive: Leveraging NIST for Improved Threat Detection & Response

During the April TRU Intelligence Briefing, our Threat Response Unit (TRU) reviewed:
- Search Ad Evolution: eSentire TRU researchers discuss threat actor developments related to the use of malicious search ads to distribute malware.
- ScreenConnect Exploitation: An overview of the recently exploited ScreenConnect vulnerabilities (CVE-2024-1709/CVE-2024-1708), including details on real-world attacks and eSentire’s response & recommendations.
- Updates on More_eggs, Koi Loader and Agent Tesla.
- Notable vulnerabilities impacting Fortinet, JetBrains Team City and XZ Utils.
- A brief update on notable cyberattacks related to ongoing geo-political tensions.

April 2024 TRU Intelligence Briefing

In this webinar, Spence Hutchinson, Staff Threat Intelligence Researcher at eSentire will discuss:
- The top trends eSentire’s Threat Response Unit (TRU) has observed about Ransomware-as-a-Service and the DW providers that enable attacks including initial access brokers, credential markets and information stealing malware.
- Why leveraging proactive threat intelligence and research is critical to stay ahead of the evolving threat landscape, inform your cybersecurity strategies, and reduce cyber risk.
- Why real-time DWM and correlation are important for threat context to inform decisions based on data residing in DW networks.
- How to correlate your business’s internal security context with deep and dark web threat intelligence to predict threat actor moves and extend visibility into early Indicators of Compromise (IOC) with the power of eSentire’s DWM service with MDR.

From Defense to Offense: Leveraging Threat Intelligence & Dark Web Monitoring

During the March TRU Intelligence Briefing, our Threat Response Unit (TRU) reviewed: 
- Threat Landscape: A review of malware recently observed by eSentire’s SOC such as Bloody Ransomware, Sorillus RAT, and Rusty Stealer, as well as notable vulnerabilities impacting ConnectWise (multiple), Outlook (CVE-2024-21413), and JetBrains (CVE-2024-27199).
- A brief update on notable cyberattacks related to ongoing geo-political tensions.
- Deepfake Video Phishing: eSentire TRU researchers detail a recent deepfake phishing incident that cost a Hong Kong company $25M and share advice on how to avoid becoming the next victim.
- Active Phishing Techniques & Security Recommendations: A review of several active phishing techniques and security recommendations from eSentire’s Tactical Threat Response (TTR) team.

March 2024 TRU Intelligence Briefing

During the February TRU Intelligence Briefing, our Threat Response Unit (TRU) reviewed:
- Threat Landscape: A review of malware recently observed by eSentire’s SOC such as Atomic Stealer, Ducktail, and SocGholish, as well as notable vulnerabilities impacting Ivanti (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893), Atlassian (CVE-2023-22527), and Apache (CVE-2023-46604).
- A brief update on notable cyberattacks related to ongoing geo-political tensions.
- Ransomware Readiness: A discussion of highlights and key takeaways from eSentire's newly released ransomware report.
- Initial Access – Exploiting Public Facing Applications: Observations associated with ongoing exploitation of edge devices and eSentire responses and best practices to follow.

February 2024 TRU Intelligence Briefing

During the November Threat Intelligence Briefing, our Threat Response Unit (TRU) reviewed:
- QR Code Phishing: Overview of the uptick in QR code phishing attacks (also known as quishing), what they look like, and how threats like DadSec Phishing-as-a-Service (PhaaS) are abusing them.
- eSentire observations and response actions related to Adversary-in-the-Middle (AiTM) attacks and best practices to defend against these attacks.
- Updates on PikaBot, Customer Loader, and Nitrogen Campaign.
- Notable vulnerabilities impacting Atlassian, Citrix, and F5 BIG-IP Vulnerabilities.
- A brief overview on cyberattacks related to the ongoing geo-political tensions.

November 2023 TRU Intelligence Briefing

Phishing

Malware

Vulnerabilities

Cyber Attacks

Cyber Defense

Threat Intelligence

Threat Hunting

Threat Analysis

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Get powerful emerging technology insights from influential experts. Connect with thought leaders and colleagues to get the most up-to-date knowledge on technologies like 3D printing, pervasive robotics, natural interfaces, connected everything and cognitive systems.

Emerging Technologies

The research and development community on BrightTALK brings together leading professionals in healthcare, technology and manufacturing to present on current topics in their fields. From big data in healthcare to online forensics training and medical research practices, the community is an exceptional resource for those looking to expand their knowledge. Be part of the conversation by joining the community and participating in interactive live webinars.

November 2023 TRU Intelligence Briefing

Presented by

About this talk

More from this channel