A Crime Scene Investigation Approach to Endpoint Security
In the rapidly evolving field of cybersecurity, ransomware has become a significant threat, causing substantial financial and operational damage across various industries. In 2024, the average ransom demand exceeded $5.2 million, highlighting the increasing severity of these attacks.
To effectively tackle ransomware, we need to adopt a thorough investigative strategy, much like how one would examine a crime scene. This involves creating a causal graph, which is essentially a detailed map of events and interactions on an endpoint. This map helps us trace the ransomware back to its source, understand how it spread, and implement steps to prevent similar incidents in the future.
A key advantage of this approach is that it can be done directly on the endpoint, avoiding the pitfalls of cloud reliance. This way, we don’t have to deal with issues like large data volumes or higher storage costs that can arise with service providers. Plus, it minimizes the risk of missing critical Indicators of Attack (IOAs) that could slip through the cracks.
The Surge of Ransomware in 2024
In 2024, ransomware attacks escalated in both frequency and sophistication:
February
Change Healthcare
Compromised via a malicious file download, the BlackCat/ALPHV ransomware employed code obfuscation and legitimate tools to evade detection.
May
Ascension Health System
An employee’s download led to disruptions, likely through fileless execution or exploitation of trusted applications, bypassing the EDR system.
November
City of
Columbus
Compromised via a malicious file download, the BlackCat/ALPHV ransomware employed code obfuscation and legitimate tools to evade detection.
These incidents highlight the limitations of traditional Endpoint Detection and Response (EDR) and Endpoint Protection Platforms (EPP), which often rely on known signatures and behavior.
Understanding Causal Graphs in Cybersecurity
A causal graph is a visual representation of cause-and-effect relationships between events. In cybersecurity, nodes represent events (e.g., process executions, file modifications), and edges denote the causal relationships between them. Causal graphs are used as an effective means of evaluating the relationships between events in order to best predict what should happen next in a sequence.
Key Component 1
Nodes
Individual events or actions (e.g., a process starting).
Key Component 2
Edges
Directed connections indicating causality (e.g., Process A spawns Process B).
Key Component 3
Temporal Alignment
Ensuring events are chronologically ordered to maintain accurate causality.
A Deeper Dive
Causix Engine
UpSight has introduced its patented Causix inference engines, derived uniquely from causal graphs, which are best leveraged to detect the behavior associated with ransom actors. Causal Graphs allow UpSight to leverage new approaches that far exceed the capabilities of legacy anomaly detection engines, which tend to focus on time-based behavioral patterns. This approach captures the temporal relationships between various events but, more importantly, the causality of those events, enabling a more effective and effectual means of discerning a malicious actor displaying the behaviors indicative of malicious intent. UpSight analyzes these patterns in real-time, on the endpoint, in order to accurately predict malicious and suspicious behaviors of the system, discerning between normal, suspicious, and malicious events.
Advantage 1
Dynamic Analysis
Small Language Models help defend against AI-driven ransomware, privileged LoLBins, and evolving EDR bypass methods.
Advantage 2
Preemptive Detection
Aligned to the patterns of attacker tactics, techniques, and procedures.
Advantage 3
Real-Time Monitoring
Facilitates immediate detection and response at the point of impact.
Advantage 4
Causix Graphs
Post-mortem attack graphs aligned uniquely to Mitre ATT&CK
SmartRollback: Reversing the Damage
UpSight’s SmartRollback feature leverages causal graphs to not only detect but also reverse malicious activities, such as:
Key Feature 1
Scheduled Task
Identifies and removes malicious tasks set by ransomware.
Key Feature 2
Registry Key
Restores registry settings altered during the attack.
Key Feature 3
File Decryption
Utilizes a proprietary approach to restore affected files.
By maintaining a detailed record of system activities, SmartRollback can effectively “rewind” the system to its pre-attack state.
Real-World Application: LockBit Ransomware
The LockBit ransomware group exemplifies the challenges posed by modern ransomware:
Threat Prevention Scenario 1
Initial Access
Exploits vulnerabilities in Remote Desktop Protocol (RDP) servers or uses phishing emails.
Threat Prevention Scenario 2
Lateral Movement
Utilizes tools like PsExec and Cobalt Strike to spread within networks.
Threat Prevention Scenario 3
Evasion Techniques
Employs code obfuscation and legitimate tools to avoid detection.
In 2024, LockBit targeted various organizations, including the University Hospital Center in Zagreb, causing significant disruptions. Traditional EDR systems struggled to detect and respond to these sophisticated attacks, underscoring the need for advanced detection methods like causal graph inference models.
The Importance of Comprehensive Endpoint Analysis
Understanding the entire operation on an endpoint is crucial for effective ransomware defense:
Analysis 1
Early Detection
Exploits vulnerabilities in Remote Desktop Protocol (RDP) servers or uses phishing emails.
Analysis 2
Attack Reconstruction
Causal graphs provide a clear sequence of events, aiding in forensic analysis.
Analysis 3
Effective Remediation
Features like SmartRollback can reverse changes made during the attack, minimizing damage and recovering quickly.
By adopting a holistic view of endpoint activities, organizations gain resilience and are better prepared for ransomware operations.
Visualizing the Attack
A Hypothetical Scenario
Conclusion: Proactive Defense Through Causal Analysis
As ransomware operations continue to evolve, traditional detection methods fall short. By leveraging causal graphs and advanced AI techniques, organizations can gain a comprehensive understanding of attacks, enabling proactive defense and effective remediation. Tools like UpSight’s SmartRollback exemplify the power of this approach, offering a means to not only detect but also reverse the damage caused by sophisticated ransomware threats.
Let's Tackle Ransomware Together
Get Started with Upsight
Like Nothing You've Seen. Demo Today & Experience Upsight
Schedule Your Demo
