Active monitoring of evolving threats, proactive threat hunting across customer environments, continuously updated IoCs, and more
Takeaways
- Barracuda Managed XDR’s global SOC saw a 10-fold increase in malicious network traffic from Iran to the United States on February 25, just before the start of the conflict.
- The SOC team is operating at an elevated alert state, protecting customers from rapidly evolving risk.
- Customers are also advised to reinforce essential security measures to manage risk.
Just before the start of the conflict in the Middle East, Barracuda Managed XDR’s global Security Operations Centre (SOC) observed a notable increase in cyber activity, with a 10-fold rise in malicious traffic from Iran to the United States. This spike reflects the intense and widely reported cyber activity between Iran, its adversaries, their allies, and other countries. The threats continue to evolve.
To keep customers protected, the SOC team is currently operating at an elevated alert state of readiness and is actively conducting threat monitoring and proactive threat hunting across customer environments.
Monitoring and practical measures
The SOC continues to monitor the threat landscape and implement additional protective measures as the situation evolves.
The SOC is actively integrating into its threat intelligence platform all verified malicious threats that originate from or are linked to Iranian cyber actors — such as domains, IP addresses and URLs. The threat intelligence platform already holds around 14 billion indicators of compromise, including ones related to the current Middle East conflict.
Customer environments are scanned the moment a new threat is identified.
The security rules and detections for Barracuda Managed XDR’s Endpoint Detection and Response (EDR) solution, delivered through SentinelOne, are continuously updated with the latest intelligence.
Customers using the SentinelOne feature should consider activating Platform Detection Library rules, if they have not already done so, to further extend coverage.
The following EDR rules are shown to protect against currently known Iranian cyber operations:
| Threat category | Rule name | Description |
| MuddyWater | Possible MuddyWater DLL Drop Consistent with Audio Driver Sideloading | Detects a dynamic-link library (DLL) being written in a manner used by the MuddyWater cyber espionage group |
| Credential dumping | Suspicious Task Creation for Credential Harvesting | Detects a task creation event that runs tools used for credential theft |
| Python-Based Network Exploitation Tool | Detects Python-based hacking tools used for lateral movement and post-exploitation activities | |
| Potential LSASS Dumping Tools | Detects presence of common tools used to dump credentials in Local Security Authority Subsystem Service (LSASS) | |
| Credential Dumping via Shadow Copy | Detects credential dumping via shadow copies | |
| Interactive NTDS Harvesting via VSS | Detects user-initiated attempts to harvest NTDS.dit via Volume Shadow Copy Service (VSS) | |
| Cached Domain Credential Dumping | Detects the listing of cached credentials using cmdkey.exe | |
| Tunnelling & remote access | Ngrok Domain Contacted | Detects DNS to ngrok domains |
| Cloudflare Persistent Tunnel Establishment Detected | Detects Cloudflare persistent tunnel establishment | |
| Anomalous Process Initiating Cloudflare Tunnel Traffic | Detects unusual processes establishing a Cloudflare tunnel | |
| Collection & exfiltration | Keylogging Script via PowerShell | Detects PowerShell using functions that could be used for keylogging |
| Chromium Browser Info Stealer via Remote Debugging | Detects remote debugging on Chromium browsers being used for credential harvesting | |
| Browser Credential and Cookie Data Access Attempt | Detects credential and cookie access attempts | |
| PowerShell/script abuse | PowerShell Script Execution via Time Based Integer IPv4 | Detects PowerShell execution that runs remote scripts while using time-based integer IPv4 |
| Suspicious Usage of .NET Reflection via PowerShell | Detects .NET reflection from PowerShell scripts | |
| Encoded PowerShell Launching Command Line Download | Detects encoded PowerShell commands that launch a download | |
| Defence evasion, impact, discovery | Potential DLL Sideloading in PerfLogs Directory | Detects DLL sideloading in PerfLogsdirectory |
| Disk Data Wipe Attempt via Dd Utility | Detects use of dataset definition (dd) utility to wipe a disk | |
| Boot Configuration Tampering via BCDEdit | Detects modification of boot configuration data (BCD) to maximise disruption via BCDEdit | |
| BloodHound Active Directory Reconnaissance File Creation | Detects execution of BloodHound and alternative tools |
Recommended security measures for all companies
Alongside the deep, 24/7 cyber resilient protection provided by a security solution such as Barracuda Managed XDR, there are practical steps that organisations can take to boost their cyber resilience during times of elevated risk. These include:
Network security
- Implement country-level blocking at the firewall for regions where your organisation doesn’t conduct business
- Disable public-facing implementations of the Remote Desktop Protocol (RDP), enforce multifactor authentication for all remote access and monitor logs for failed and unusual logins. Lock people out after three to five failed attempts and consider replacing RDP with virtual desktop infrastructure (VDI) instead of direct RDP
- Check to see if there are any unused remote access ports and disable them if they are not in use
- Implement network segmentation to limit lateral movement
- Use privileged access workstations (PAWs) for administrative tasks
Firewall settings
- Review all inbound and outbound firewall rules
- Remove any rules that are set to “permit any”
- Document and justify all external access rules
- Pay special attention to rules allowing access from foreign IP ranges
Password policies
- Enforce long (14 character) passwords
- Require complexity: uppercase, lowercase, numbers, and special characters
- Prevent password reuse and consider enforcing password updates every 60 to 90 days
Other essential measures
- Prioritise software updates
- Check the applications installed on all corporate devices and remove unauthorised or unnecessary applications
- Pay special attention to remote access tools, such as TeamViewer and AnyDesk
- Look for legitimate tools that could be abused – including PSExec and PowerShell ISE
- Ensure your backup systems are isolated and tested, and maintain offline backups of critical data
- Revisit and update your incident response plan
Stop threats with 24/7 managed cybersecurity – contact the PMD Team today to arrange a walk though