incident response Archives

Qilin ransomware caught stealing credentials stored in Google Chrome

by unitedimaging on August 22, 2024

Familiar ransomware develops an appetite for passwords to third-party sites Contact us today for more information about SOPHOS cyber security solutions

Don’t get Mad, get wise

by unitedimaging on August 13, 2024

The “Mad Liberator” ransomware group leverages social-engineering moves to watch out for Contact us today for more information about SOPHOS cyber security solutions

RD Web Access abuse: Fighting back

by unitedimaging on June 12, 2024

Investigation insights and recommendations from a recent welter of incident-response cases Contact us today for more information about SOPHOS cyber security solutions

Sophos Incident Response achieves NCSC Certified Incident Response (CIR) Level 2 status

by unitedimaging on May 14, 2024

I am delighted to announce that the Sophos Incident Response service has been awarded U.K.’s National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Level 2 status by CREST. This […]

Extracting data from encrypted virtual disks: six methods

by unitedimaging on May 13, 2024

For incident responders, a variety of techniques for information retrieval from locked-up VMs Contact us today for more information about SOPHOS cyber security solutions

It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024

by unitedimaging on April 3, 2024

The latter half of 2023 found numerous fronts on which attackers failed to press ahead. Are defenders failing to take advantage? Contact us today for more information about SOPHOS cyber […]

Remote Desktop Protocol: The Series

by unitedimaging on March 20, 2024

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary […]

Remote Desktop Protocol: Exposed RDP (is dangerous)

by unitedimaging on March 20, 2024

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data […]

Remote Desktop Protocol: How to Use Time Zone Bias

by unitedimaging on March 20, 2024

Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs Contact us today for more information about SOPHOS cyber security solutions

Remote Desktop Protocol: Queries for Investigation

by unitedimaging on March 20, 2024

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits Contact us today for more information about SOPHOS cyber […]

Remote Desktop Protocol: Executing the 4624_4625 Login Query

by unitedimaging on March 20, 2024

Keeping an eye on who’s trying to get onto your network – whether or not they’re successful – can pay off on multiple fronts Contact us today for more information […]

Remote Desktop Protocol: Executing the External RDP Query

by unitedimaging on March 20, 2024

On the hunt for successful RDP connections that have entered your network from outside? A step-by-step guide (and a query to get you started) Contact us today for more information […]

The song remains the same: The 2023 Active Adversary Report for Security Practitioners

by unitedimaging on November 14, 2023

The remarkable decline in attacker dwell time is now well-documented, but what does that mean for those doing the hands-on work of infosecurity? Contact us today for more information about […]

Identifying Group Policy attacks

by unitedimaging on November 8, 2023

A threat hunt looks at three attacker changes to a compromised Active Directory, and explains how to both understand and overcome them Contact us today for more information about SOPHOS […]

Introducing the Sophos Incident Response Services Retainer

by unitedimaging on September 1, 2023

An elite team of incident response experts on standby to get you back to business quickly in the event of a breach. Contact us today for more information about SOPHOS […]

Time keeps on slippin’ slippin’ slippin’: The 2023 Active Adversary Report for Tech Leaders

by unitedimaging on August 23, 2023

A deep dive into incident-response cases from the first half of this year finds both attackers and defenders picking up the pace Contact us today for more information about SOPHOS […]