Sophos X-Ops Archives - Page 2 of 6

Driving lessons: The kernel drivers in Sophos Intercept X Advanced

by unitedimaging on August 1, 2024

Operating in kernel-space is necessary, but risky – here’s how we do it in Sophos Intercept X Advanced Contact us today for more information about SOPHOS cyber security solutions

July Patch Tuesday Unleashes a Torrent of Updates

by unitedimaging on July 9, 2024

Microsoft fixes 138 bugs in Windows and other products this month Contact us today for more information about SOPHOS cyber security solutions

Phishing, BEC attackers target candidates in local election, among others

by unitedimaging on June 13, 2024

An escalating series of email-borne attacks were sent to candidates, including the author Contact us today for more information about SOPHOS cyber security solutions

RD Web Access abuse: Fighting back

by unitedimaging on June 12, 2024

Investigation insights and recommendations from a recent welter of incident-response cases Contact us today for more information about SOPHOS cyber security solutions

June Patch Tuesday squares up with 49 patches

by unitedimaging on June 11, 2024

Just one critical-severity issue addressed, but don’t sleep on an industry-wide DNS issue Contact us today for more information about SOPHOS cyber security solutions

‘Junk gun’ ransomware: Peashooters can still pack a punch

by unitedimaging on April 17, 2024

A Sophos X-Ops investigation finds that a wave of crude, cheap ransomware could spell trouble for small businesses and individuals – but also provide insights into threat actor career development […]

Smoke and (screen) mirrors: A strange signed backdoor

by unitedimaging on April 9, 2024

Sophos X-Ops discovers a curious backdoored (and signed) executable, masquerading as something else entirely Contact us today for more information about SOPHOS cyber security solutions

Remote Desktop Protocol: The Series

by unitedimaging on March 20, 2024

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary […]

Remote Desktop Protocol: Exposed RDP (is dangerous)

by unitedimaging on March 20, 2024

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data […]

Remote Desktop Protocol: How to Use Time Zone Bias

by unitedimaging on March 20, 2024

Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs Contact us today for more information about SOPHOS cyber security solutions

Remote Desktop Protocol: Queries for Investigation

by unitedimaging on March 20, 2024

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits Contact us today for more information about SOPHOS cyber […]

Remote Desktop Protocol: Executing the 4624_4625 Login Query

by unitedimaging on March 20, 2024

Keeping an eye on who’s trying to get onto your network – whether or not they’re successful – can pay off on multiple fronts Contact us today for more information […]

Remote Desktop Protocol: Executing the External RDP Query

by unitedimaging on March 20, 2024

On the hunt for successful RDP connections that have entered your network from outside? A step-by-step guide (and a query to get you started) Contact us today for more information […]

The 2024 Sophos Threat Report: Cybercrime on Main Street

by unitedimaging on March 12, 2024

Ransomware remains the biggest existential cyber threat to small businesses, but others are growing. Contact us today for more information about SOPHOS cyber security solutions

It’ll be back: Attackers still abusing Terminator tool and variants

by unitedimaging on March 4, 2024

First released in May 2023, an EDR killer – and the vulnerable Zemana drivers it leverages – are still of interest to threat actors, along with variants and ported versions […]

ConnectWise ScreenConnect attacks deliver malware

by unitedimaging on February 23, 2024

Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments Contact us today for more information about SOPHOS cyber security […]