CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

solutions simply played or executed this zero-day-file that was not seen before in a safe
environment where its behavior was analyzed to see if it displayed malicious behavior. Likewise,
machine learning was used to look at files that have taken source code from a known exploit but
changed the code a bit to create a new executable and hence a new hash. This form of attack,
where you changed a known malware slightly to create a brand-new malware with a new hash
value, but the source code was essentially the same, was called polymorphism.
The Birth of Endpoint Detection and Response (EDR)
The security industry changed with Operation Aurora, a series of cyber-attacks conducted against
well-known technology companies by a nation state. Operation Aurora exploited a well-known
vulnerability in Internet Explorer to spawn a PowerShell that could be used to execute commands
on the target system. The earlier approach of checking file hashes would not have worked as
Internet Explorer and PowerShell are legitimate commands; it is the sequence that is illegitimate.
A browser could spawn another browser, it could spawn a music player but should not be
spawning a power-shell under normal circumstances.
The rise of nation state attackers who kept infiltrating each other’s private enterprise and critical
sectors such as finance and energy contributed to this trend.
Endpoint detection and response tools work by monitoring endpoint and network events and
recording the information in a central database where further analysis, detection, investigation,
reporting, and alerting take place. Endpoint Detection and Response solutions had four
components:
1. Detection
2. Threat hunting
3. Response & Remediation
4. Managed Services
It all starts by recording everything at the endpoint – every file access, every registry call and
every network connection was recorded from the endpoint and sent to the cloud. These actions
were stitched together and scanned to see if there were malicious or suspicious sequences of
activities, such as an internet browser spawning a PowerShell. Likewise, an attacker running port
scans and scanning systems laterally using known windows utilities would evade signature
defenses but be caught by an endpoint detection and response system as his behavior would
trigger an alarm.