A Guest Post by Giorgos Karantzas and Professor Constantinos Patsakis

Introduction

A few years ago, a vigilante hacker under the name “Phineas Phisher” conducted a series of high-profile attacks, including hacking into a company that, among others, was developing and selling spyware to government agencies named “Hacking Team”. This was not a result of a random attack but a well-planned and targeted one.

To achieve his goals, the hacker developed a 0-day for the SonicWall VPN appliance. After this attack, the attacker scanned the internet for such devices and found out that an offshore bank in the Cayman Islands was using the same vulnerable version. Beyond this exploit, he reported through his write-ups that he used common hacker utilities like Meterpreter and Empire and that he was not some kind of APT with custom malware writers nor did he receive significant funding and support; on the contrary, he claimed to be a humble ‘one-man army’.

The final goal of the bank hack was to access Bottomline’s SWIFT management panel and initiate transactions targeting his own accounts. Then, he uploaded the VMs used by the bank along with all the sensitive clients’ information that was stored in these systems.

The scenario is rather intriguing as, despite the impact and sensitivity of the information, it provides a deep insight into an environment in which few people operate. Moreover, such environments are not well publicly documented, and their digital twins are hard to find.

We argue that emulating such an attack scenario and adapting it to current tools and methods, offensive and defensive-wise, can provide a good baseline to understand the capabilities of both sides and stress the changes that have undergone these years. To this end, in our scenario, we have tried to follow the evolution in defensive and offensive security by rebuilding such an environment and equipping it with modern defense mechanisms.

Since most organizations are now integrating endpoint detection and response (EDR) systems to their endpoints to behaviorally detect and throttle cyber-attacks, we have equipped our endpoints accordingly. However, as shown in our previous research, EDRs are no silver bullets and have their weak points as well. In fact, Advanced Persistent Threat (APT) groups have significantly advanced their capabilities. Having access to several such defensive technologies, they study them and customize their malware accordingly to target them and minimize their detection. Moreover, APTs and ransomware groups use several C2 frameworks, with the most widely used being Cobalt Strike; however, there are different options that may provide different capabilities and serve fit better in the cyber kill chain.

Based on the above, this work can be considered a purple teaming scenario in the financial sector. Practically, we present the blue versus red team fight detailing, where possible, detection and bypass methods, their rationale, and gaps, where applicable, mainly through the use of C2 servers. We present in each step the attacker’s and defender’s perspectives of the same scenario. This means that we report by what means an EDR would report and/or block and how the attacker would try to prevent this.

Experiment Background and Differences with Common Tests

Unlike common tests like MITRE ATT&CK, our threat actor is highly adapted to the target’s defenses as any serious actor would do instead of placing a generic baseline. Such an actor’s type of offensive security ranges from basic attacks and operations performed on the network to weaponizing a series of private toolkits, from the highest end and combat-proven solutions to lesser-known yet highly effective options.

The lab’s architecture did not emulate human traffic, thus denying  the attacker typical places to hide and admittedly offering an advantage to EDR solutions as the samples would stand out easily. Detection engineering can be considered the art of avoiding false positives, and in these cases with low traffic, there are not many chances of blending in with regular user and applications traffic; therefore, we tried to mimic this as static principles to be followed in the environment we had.

Given this fact, we decided to constantly modify the policies ranging from production-ready to BETA features, pushing both the researchers conducting the experiment and the product, leading to highly sensitive discoveries that were kept private to ensure SentinelOne’s client safety. In close collaboration with the RnD department of SentinelOne, several bugs were reported and fixed as well as real-world bypasses and architectural blind spots.

We weaponized the statistically more probable way of entering an organization and exploited several post-foothold TTPs through a series of ways and frameworks enabling operational and scientific diversity.

Network Architecture Analysis

We try to keep the scenario simplistic yet expose a complex mindset, ideas and tooling (at points); therefore, we consider the case of a financial institution that is based on a recreation of Sherwood’s target network; the infrastructure of Cayman Island National Bank and Trust that Phineas Phisher penetrated, reconfiguring it and extending it with new machines on a Hyper-V server. On the network level PfSense, Virtual Switches, RRAS and Squid were used to enforce network segmentation and security policies. Mainstream applications and banking related ones were installed on servers and workstations, a virtual Citrix XenApp instance was used and a virtual SWIFT secure zone was emulated as well using jump servers. Various versions of Windows that were production ready were used and several security features such as Credential Guard were employed on hosts to stage a scenario with a minimum level of operational sophistication and realism. In general, the network design allows us to demonstrate several privileged and unprivileged attack vectors by giving local admin access on some endpoints and allowing loading of kernel drivers and performing several other actions.

Toolset Analysis

During this study we will go through several tools of various levels of sophistication. Of specific interest are the C2s that the attacker may use. To this end, we provide a brief overview of each one.

Brute Ratel

Brute Ratel C4, by Dark Vortex, is one of the most ambitious attempts we have seen in the industry. It is a low cost alternative to Cobalt Strike with less well-known indicators, more opsec and user friendly, as well as adaptable. It is maintained by a highly active developer with serious red teaming experience who is adding an increased number of features to the core.

Some of the highlights include the custom plugin called LDAP sentinel which can be used for enumeration, the customized reflective loader and the BOF files as well as the easily configurable TTPs ranging from the network communication to process injections and more.

BRC4 should be a solution capable of bringing all operations to a successful end.

Version 0.7 was the latest at the time of testing and version 0.8 was tested; however, new versions come out quickly making them hard to follow. After a comment from the developer, we replicated some tests with the latest version at the time, 0.9.

Notably, during our testing process we faced several limitations. The most important limitation being the form of delivery.

Before continuing we should make a note. BRC4 is a new product, this justifies some stability issues related to the shellcode upon execution that would lead to a “half-beacon” that crashes immediately after execution. We attempted several times to conduct each attack and we managed to successfully execute the beacon in both protected and unprotected machines. We noticed based on the frequency of the crashes combined with the creation of the werfault process and the fact that the badger was unusable that the crash of the badger was more probable to happen on VMs protected with an In-Process agent.

Cobalt Strike 4.4

Cobalt Strike is the norm when it comes to C2 frameworks. It provides the core functionality needed to perform basic operations but is also fully extendable. We can see that a significant amount of the work is done by the community judging from the plug-ins in the forms of BOFs, Reflective DLLs, various kits etc. The latest version at the time of the writing of this section is 4.4 and it is the one we are using in our experiments. In this version, among others, a custom reflective loader capability is introduced, meaning you can replace the default one with your own, like boku7’s implementation. Moreover, you can use BOFs, pieces of code that will be executed inside the local process and avoid default fork and run behavior of the version.

Cobalt Strike is not that opsec safe anymore, yet you can always implement several security features on your own and embed them on your loader.

In our case, most of Cobalt Strike’s out-of-the-box features and kits will not be helpful as many detections nowadays are multi-layered and generic which means they try to target the very core of the threat and adapt to different usage scenarios from an attacker’s point of view. We will present a few POC detections from various commercial tools to support the fact that a wide range of IOCs exists, and the framework will have high chances of being detected at least at some point in a highly advanced network that will employ various defenses.

Therefore, a combination of TTPs may be needed including using other C2s, customizing tradecraft and tailoring Cobalt Strike both host wise and network wise to the target (e.g., sideload into teams and make traffic look like legit teams’) but retaining guardrails against both UM and KM based detections), something that could cost a large amount of time and effort while other tools could be simply more effective for specific tasks.

However, although some of the offensive coders out there are highly skilled, the stability of some publicly available tools is questionable as they are mostly created during someone’s free time and not the same way as a production software maintained by a company. However, the most important part is that Beacon will usually get detected one way or another even when some customization takes place.

Cobalt Strike in all our tests needed us to conduct monstrosities to be able to use it, usually after some tampering occurred based on privileged attacks or product-specific bugs which again did not guarantee success.

Havoc

Havoc represents the category of malware that is not a commercial product; rather, it was developed by an aspiring, young security researcher who is still a student. We therefore wish to demystify this kind of tool and demonstrate the capabilities of non-corporate software developed with stealth and stability in mind.

Havoc was built targeting the vast majority of endpoint solutions and therefore it had a few IOCs by design. We assisted the developer to transition the software to a more suitable condition for this scenario by contributing slightly in the development process.

The network communication is performed through the TCP protocol’s sockets with AES encrypted content and capability of sleeps during which no command will be fetched.

Havoc has proven to be able to go through extremely hardened environments as long as the operators are willing to employ some basic op-sec techniques and modify the code base.

Nighthawk by MDSec

Nighthawk is a high-end C2 framework developed by MDSec designed by hardcore red teamers for hardcore red teamers with stealth, configurability, and feature richness in-mind. This toolkit is the tip of the spear for several reasons as we will discuss in our experiments and offers by design capabilities that would require serious amounts of work to adapt to existing tooling or even create custom tooling. As of this writing, MDSec has added even more features than those used in this work, including some stealthy injection chains that will bypass even ETWTi and spoofing strategies for mini-filter callbacks.

Nighthawk delivers a set of op-sec features which includes ROP-based system call unhooking and later on full DLL unhooking which comes “by-design” therefore it makes the operator’s life easier, it also includes other useful features like Thread Stack Spoofing and in-memory hiding via heap-based encryption as well as it usually avoids several tools (depending on the case) that will scrap through the memory of a process for abnormal indicators such as. The idea behind Nighthawk is being fully malleable which means you can control all the behavior of the C2 manually without writing any code. This enabled us to change the behavior of the implant during the operation according to our needs. This means among others, customized process injection methods, universal usage of system calls and network-callback related options to guarantee undercover beaconing.

At this moment Nighthawk was proven to be the most feature rich, stable and effective solution we used.

Oyabun – Stage 0

Oyabun is a newly created tool by Red Code labs with a somewhat more generic and limited scope when it comes to its usage. It is a multi-platform Golang based toolkit that has proven to be highly effective against modern defenses to pass some initial barriers. The more time passes, the more its instabilities reduce thanks to the development team’s commitment, although the design is solid from time-to-time discrepancies may occur.

In this case, we will not test a C2 framework such as Nighthawk, BRC4 or Cobalt Strike. Those aforementioned frameworks are armed with highly advanced features related to opsec and can be used to reach objectives at all stages of the intrusion.

There are, however, cases, that a specific malware strain will be deployed to deploy later those heavy weapons. This malware is called “stage-0″ as it is the first malware performing callbacks to a server controlled by the attacker to touch the victim network.

Modus Operandi

The main goals of the actor included:

• Operate below the radar.
• Tamper with endpoint defenses as much as needed from user mode hook avoidance and removal to offensively render the EDREPP solution useless.
• Demonstrate both operational security principles and bare minimum needs for an attack to be successful even if this means increased footprint that can be exploited by the defenders.
• Demonstrate diverse ways of achieving goals including different tools and mindsets.

Initial Access

The toolset that was used included both lesser-used and regarded techniques and ones that are extremely popular and trending but with high adaptations to the internal mechanisms of the defensive tools. Several malicious files including XLLs, MSIs, EXEs were used for initial access and even privileged attack packages impairing the defenses using exploitable drivers to inject into free AV software as it was one of the few ways to totally avoid the in-process client. DLLs with cloned exports were used for hijacking into legitimate applications our unstaged payloads in some cases.

SentinelOne demonstrated a capability of disallowing generic threats on-touch including Cobalt Strike and BRC4 in many different ways.  SentinelOne’s traps sustained spoofing the format of the BRC4 code provided, including many different more “exotic” and customized loading types such Customized Phantom DLL Hollowing, commercial tools like Shellter Pro, MacroPack and more, something that surprised us. In the case of Nighthawk, malleability, bug fixes and delivery format enabled us to step on the network leaving the defenders valuable context of the attack.

Havoc needed customization to survive in the environment and our team collaborated with the developer leading upgrades to Havoc C2.

Oyabun was able to survive but only for a few limited actions and for a very specific format that could be targeted by Application Whitelisting.

Post-Ex Tool Deployment

Tools were deployed in various ways including reflection, heavily monitored, yet working PowerShell sessions and CLR loading but always under a safe context op-sec wise to cover beaconing and tool execution as much as possible. The researchers managed to circumvent all PIC-related mitigations and run malicious post-ex tools in various formats. Admittedly, those mitigation covered 90% of the attempts made and needed heavy customization.

Tampering

Tampering occurred in many cases using exploitable drivers during the experiments but also we were able to find ways to completely disregard all user mode traps with several techniques one being NightHawk’s ROP based system call unhooking scheme and the other one being a bugs in the logics that our team discovered and reported.

Lateral Movement

Lateral movement included RDP, WMI, WinRM, an WebDAV based internal phishing toolkit called the Farmer and Credential Stealing Tool in PIC, PIC that was essential a PE-Loader Bootstrapped to the code such as sRDI and executable forms to collect credentials and of-course SOCKS proxying with an RDP client. When it came to credential dumping from processes like LSASS, we had to avoid all common techniques and had serious problems executing the attack that led us to exploit a bug in SentinelOne’s architecture to be able to have such an opportunity, something unlikely to happen in the wild.

Process Injection

The detection model employed limits usage of common evasion techniques and injections targeting both the technique and the shellcode itself, it took a significant amount of effort to bypass those guardrails in place place, yet again kernel-based traps caught the behavior of the PIC. At this place we revealed bugs that were immediately fixed, related to SentinelOne’s APC protections raising the bar for attackers again. Our experience taught us that such attempts are easy to complicate things with SentinelOne and we avoided risking our context.

Ransomware

Although ransomware was not the goal of such an attacker, known variants with customized loaders performing various injections with heavily modified payload format, including Ryuk, Ragnar and Babuk, were successfully mitigated, some at a ransomware and some at deployment levels.

SentinelOne’s Outcome

Given the sensitivity of the tests, not much can be revealed to ensure clients are safe.  SentinelOne’s team indeed took into account our proposals and our various bug and miss reports and during testing, the product was able to effectively tackle most of the generic attacks existing out there as “out-of-the-box” solutions (always depending on the policy). What  SentinelOne does is push the attacker while giving the defender valuable context that could be later exploited using STAR rules to effectively track down specific attackers. That said, a holistic model that tackles at the right points the attacker is invaluable and something that can be achieved to some extent if proper configuration occurs. Having the chance to BETA test some of the upcoming features we can say that the upcoming stability could ease the defenders’ side by making the customization more and more necessary costing to the attackers a lot.

Overall Outcome

Nowadays, true value comes in information, and goal-driven intelligence has met an outstanding amount of development in recent years, especially following the advancements in personal, corporate, public, and critical infrastructure.

Threat actors may come from various backgrounds, being government-sponsored, self-motivated based on curiosity, financially motivated, hacktivists and more. However, the goals can be achieved through a common chain of actions. This chain is what modern security vendors try to tackle, producing useful alerts with minimal disruption and false positives. Defensive strategies may vary per organization and per product; however, certain limitations are posed by each operating system or network appliance and must be considered. Holistically covering as much attack surface as possible is the modern goal, increasing the chances of blocking the threat actor or revealing his existence at some point at a minimum.

An environment must always be re-adapted every few months/years to a certain security model on multiple levels, from very basic security-oriented network segmentation to constantly updating assets and ensuring proper privilege management. In this study, we will face at some point such issues on purpose.

The most important asset, however, is the endpoint, whether a server or a workstation; thus, the defensive focus is primarily oriented towards this direction, where even the internals of the operating system are at stake.

The motive is not to discourage people about EDRs but to show that silver bullets simply do not exist – by using the top-notch industry products to present attack-specific examples with as much transparency as possible – and that attackers can easily investigate and adapt to most defenses. Obviously, if computers are in closed networks without plugin capabilities for devices, they will be highly secure but also more difficult to function. Today’s security personnel try to find a golden mean between functionality, security and performance.

The main point of this research, however, is that no matter how well structured a defense is, a sophisticated actor or a group of people, each with its own specialization, will be able to penetrate even some of the most advanced and mature networks. This assumption is based on the level of motivation and the time to be spent on a single objective, as well as the sophistication of the attacker. The study depicts this situation as we go through a threat emulation scenario in our own lab, representing a sensitive and high-value target. We see through the attacker’s eyes and understand how to think, research, experiment and tackle objectives one after the other while being in a constant race with the blue team. The attacker’s mistakes give the blue team the next move and vice versa.

From the aforementioned statement on the criticality of the endpoints, we can easily suppose that tooling that interacts with such endpoints is of extreme importance to the attackers. This is another focus of this study, demonstrating state-of-the-art malware, some of which is not easily accessible. This tooling will ease the execution and provide us with stealth and post-exploitation capabilities to spread across the target network.

During this journey, we explored all parts of an intrusion that will be exposed to both blue and red teams, explaining what is executed TTP-wise, why it is executed, the background concepts, and the footprint left.

All the experiments were conducted before April 2022 and any views expressed do not reflect the opinion of employers of the people involved.

Thousands of people in the cybersecurity community converged upon National Harbor, Maryland last week for Gartner’s annual Security & Risk Management Summit. For many of us, it was our first in-person industry conference since February 2020, and our excitement was palpable. Between this event and RSA Conference 2022 in San Francisco, the SentinelOne team had an exciting week connecting with our fellow cybersecurity professionals and reflecting on the latest developments in the cybersecurity landscape.

The theme of this year’s summit was “Reframe and Simplify,” a mantra that was reiterated in keynotes and breakout sessions throughout the week. “Reframe” signifies the need for security professionals to transform the conversations we have with our business leaders in order to help them understand what we do not do. As Gartner’s VP analyst Jay Heiser put it, “We can’t eliminate security failure. But we can help you understand risk and how to get back up again.”

“Simplify” is, well, simple: Only do what’s most important to mitigate risk for your business, and focus security modernization on composable security tools, like ones built with APIs that give you the flexibility to add more capabilities in the future.

Missed out on the fun? Here are some notable takeaways from the summit.

The Era of XDR is Here, But What Does it Mean?

Ask five different vendors what XDR is, and you’ll get five different answers. Ask five different analyst firms the same question, and you’ll get the same result. While certain Gartner analysts estimate that we’re about 18 to 24 months out from landing on a consistent answer, one common point of agreement among vendors and analysts alike seems to be that identity security and endpoint protection, detection and response are critical building blocks for an XDR platform.

From CAASM to xSPM, Acronyms Abound in Infosec

As modern attack surfaces expand and evolve, security experts continue to define and refine capabilities for addressing the threat vectors that follow. This is reflected in a never-ending list of industry acronyms—EASM, CAASM, xSPM, _DR, just to name a few. According to Gartner VP Analyst Pete Shoard, Managed Detection and Response (MDR) is the only “DR” that’s a service and not a technology.

Speaking of technologies, we’ve now reached the dawn of Threat Detection and Incident Response (TDIR), a SaaS-based evolution of managed services designed for maturing security practices. It is not to be confused with Identity Threat Detection and Response (ITDR), a term coined by Gartner less than a year ago to describe the collection of tools and best practices to defend identity systems.

ITDR is the New Top Trend

Heiser identified ITDR as the most forward-looking trend in his talk, “Top Trends in Security and Risk Management.” An action plan for implementation starts with prioritizing the security of your identity infrastructure with tools to monitor, protect, detect, and remediate threats. Other keys to success include using the MITRE ATT&CK framework to correlate ITDR techniques with common attack scenarios, investing in foundational identity and access management (IAM) security best practices, and modernizing your IAM infrastructure with current and emerging standards.

CISOs Must Communicate in a Language Business Leaders Understand

In a fireside chat with conference chair Patrick Hevesi, guest keynote John Brennan shared learnings from his experience as CIA Director and Senior National Security & Intelligence Analyst during the Obama administration. His key takeaway for the audience: Most of your leaders are less technical than you, so stay out of the weeds and present the facts in a way that helps them understand the impact to their business.

Born-in-the-Cloud Enterprises Provide a Guide to the Future State of Security

In “Outlook for Cloud Security,” Gartner Senior Director Analyst Charlie Winckless outlined the limitations of a lift-and-shift migration from on-premises to the cloud versus a born-in-the-cloud approach. Lifting and shifting will work to a certain degree, but you’re going to need to rethink your strategy pretty quickly. He cautioned that not all clouds are the same and pointed out that identity is now the control plane for security. He explained that “identity is a perimeter” — or in SentinelOne’s terminology, a surface — and that Cloud Infrastructure Entitlement Management (CIEM) facilitates automation of complex auditing.

XDR + Native Identity Data = Better Together

This week’s conference marked our first opportunity to showcase the Singularity XDR platform’s new identity security capabilities following our acquisition of Attivo Networks. Our combined forces spent the week demonstrating how Singularity Ranger AD, Singularity Identity, and Singularity Hologram can help organizations reduce their Active Directory and Azure AD attack surfaces, protect identity infrastructure, and detect in-network attacks and insider threats, respectively.

Integration, Partnerships and Visibility Are Key to Enterprise Security

Finally, we observed many of the same trends as our fellow Sentinels in attendance at RSAC 2022; whether pulling from firsthand practitioner experience or observing the industry at a macro level, consolidation of vendors and tools, strategic technology integrations and growing partner ecosystems, and a huge focus on gaining visibility across every segment of an expanding attack surface seem top of mind for all.

Conclusion

We didn’t have Incubus perform at a FOMO party. We didn’t have a giant purple tree calling to people from across the expo hall floor to come learn about autonomous threat defense. But with SentinelOne-branded lanyards slung around the neck of nearly every attendee, we enjoyed our own sense of omnipresence.

More importantly, over the course of a private dinner with CISOs, one-on-one meetings with Gartner analysts, and three days in the exhibit hall, we had countless meaningful conversations with people who, just like us, are deeply passionate about helping to defend organizations against cyber attacks with speed, scale, and accuracy.

We look forward to continuing these conversations and to starting new ones as we hit the road to the next show.

It’s the last day of RSAC 2022, and the SentinelOne team has been taking San Francisco by storm with a stunning booth, innovative demos, FOMO-inducing parties, and exciting announcements galore. As this tried-and-true conference draws to a close, our team decided to look back and share some of their takeaways gained from the show floor and long-anticipated conversations with customers & partners.

Welcome to the Era of XDR

Consolidation was the name of the game at RSAC 2022.

We came ready to talk about what security professionals need in their cybersecurity programs; while the answer wasn’t surprising or novel, it was universally resonant. CISOs and analysts alike talked about consolidating tools, and reducing the number of vendors and point-specific solutions they rely on.

While vendor consolidation is not a new trend or objective, the concept of extended detection and response (XDR) offered enterprises a more promising roadmap and approach to achieving its benefits.

Most importantly, we heard how today’s security teams are in need of security tools that more seamlessly integrate with the other vendors in their stack. We had a lot of great conversations about how our Singularity XDR platform can empower our customers and partners with centralized, end-to-end visibility, and how security teams can leverage a Marketplace full of integrations to protect all of your attack surfaces.

As RSAC 2022 continued, we saw that attack surface management was a top-of-mind concern for many of the booth visitors that sat down with us as well as on the show floor. Customers and peers highlighted how they were considering outside-in External Attack Surface Management (EASM) and Cyber Asset Attack Surface Management (CAASM) to gain the enterprise visibility they currently lacked. These key conversations affirmed our approach to addressing common visibility challenges by providing actionable insight into the endpoint, network, cloud, and identity layers. Without this visibility, vendors and practitioners miss the first step to accomplishing the data-driven investigations and automated response actions originally promised by the vision of XDR.

Learning more from the attendees of RSAC on the expectations and desired outcomes of XDR makes us even more excited to continue our journey to fulfill the original vision and promise of XDR by filling visibility gaps across your technology stack by correlating threats across vectors and attack surfaces.

Cloud Infrastructure Isn’t the Future. It’s Now.

This year’s RSAC also proved that everyone’s heads are in the clouds.

Previous years’ conversations that simply broached or entertained cloud transformation are over. The plans are already in motion, and today, more enterprises are turning to cloud infrastructure platforms than ever to run their operations.

And this trend shows no signs of slowing down. According to projections from Gartner, infrastructure-as-a-service (IaaS) spending will eclipse $120 billion USD in 2022, up 30% YoY.

As cloud becomes integral to an enterprise’s day-to-day, we had a lot of productive conversations about the growing number of cloud-based threats (such as runtime threats like crypto-mining malware, zero-days like Log4j, or real-time fileless attacks) on the horizon. It’s clear that enterprises and SOCs need a cloud defense-in-depth strategy, which establishes multiple layers of protection and best practice configurations around your sensitive data, with cloud workload detection & response as a reactive line of defense.

Introducing SentinelOne Skylight

We also sparked some radical conversation on the replacement of legacy SIEM—and introduced security pros to just the solution for the job.

SentinelOne kicked off Day 3 of RSAC 2022 by introducing Skylight, a solution that provides full data visibility, ingestion, and storage capabilities by integrating data from both SentinelOne and third parties within SentinelOne Storyline technology. Now, our enterprise customers can make better decisions, automate workflows, and derive more value from the data they ingest from existing technology and security tools—without the costs, upkeep, and time they’ve come to associate with traditional SIEM.

Stronger Together (Hello, Attivo!)

RSAC 2022 was the first time we hit the road with our new Identity experts following the acquisition of Attivo Networks.

Customers got to sit down with us and have their first look at the new Identity capabilities of the Singularity XDR platform.

We spoke about how Singularity Identity detects active attacks against all device types and OSes, and safeguards against unauthorized privilege escalation and lateral movement to protect your Active Directory and Azure AD domain controllers and domain-joined endpoints in real time. They also got a look at how Singularity Ranger AD can mitigate your identity-based risk by identifying misconfigurations, vulnerabilities, and real-time indicators of attack to get in line with security best practices.

As threat actors target identity-focused attack surfaces, many key discussions between RSAC attendees centered around how security teams could secure their estates and manage relevant vulnerabilities in real time— at SentinelOne, we’re glad that we can offer solutions to proactively address these attacks.

Celebrating the Good Guys

With the threat landscape constantly evolving, the security industry works hard—but we also wanted to recognize a rare moment of celebration and peace-of-mind for our valued customers and partners. That’s why we teamed up with Armis, Torq, and our special guests Incubus to bring over 2,500 people together for FOMO, our RSA party. We hope you enjoyed the celebration!

Conclusion

As we head back home to start executing on what we learned at RSA 2022, we want to thank all of the customers, partners, and peers who stopped by Booth S-627 to say hello. We can’t wait to see you next year with a few more exciting developments and contributions to the cybersecurity landscape under our belt. See you next year!

To learn more about how Singularity XDR provides visibility and context across enterprise data, schedule a demo.