Intezer

"Is the bigger risk with AI tools the information we put into them, or the accuracy of the output?" ....You can count on Ron Eddings for asking good questions about AI in cybersecurity! Thanks for hosting Roy Halevi on Hacker Valley Media's show for this conversation about the tools that are transforming security operations ?? #AISecurity #AISOC #SecOps #SecurityAutomation #Cybersecurity

Here's the data on how Intezer's AI SOC solution performed, from the annual benchmark we performed: - 3.81% alert escalation rate - 97.7% accuracy for false positive alerts - 93.45% accuracy for true positive alerts - 2 min 21 second average alert investigation time (15 sec median) More from Itai Tevet below ??

Thanks to David Spark for always hosting a great show! Our team is proud to support the CISO Series community ??

??

Great work from Ryan Robinson on the security research team explaining this sophisticated, evasive malware loader ??

AI is a tool. Smart security leaders won't replace all their people with AI tools. But they'll probably promote the SOC analysts who know how to use AI tools to their advantage. As defenders, we have to constantly evolve. We have to keep learning to stay ahead of attackers. And we have to make sure we're using the right tools, the right way. #cybersecurity #SOC #AI #securityoperations #infosec #artificialintelligence

A great SOC team that knows how to use AI to their advantage -- that's an ?amazing SOC team ?

AI automation can make a real impact for the SOC -- just ask this SOC manager and CISO?? “I actually came to learn of Intezer through my security operations center manager,” Michael Calderin, CISO of YAGEO Group – an electronics components company – told MES Computing. Calderin said that with Intezer, his team can quickly sift through alerts and respond quicker to more critical ones. “We have a very lean team, and so automation is really critical to us. The amount of time that it takes to triage an event and understand what's really happening can eat into our ability to respond quickly. So, the more information that we have up front when we get eyes on screen, the faster a human can make a decision about what to do,” he said. SOC teams already have too many alerts. Intezer is a security tool that generates ZERO new alerts. Intezer investigates and triages alerts from your security tools. It resolves false positives. And it escalates the real threats to your SOC analysts with real context. This is how our AI helps analysts and reduces MTTR. Full story here: https://lnkd.in/eXRBfxap #cybersecurity #securityoperations #AI #autonomousSOC #SecOps #infosec

Good day everyone! Ryan R. at Intezer shares with us their work analyzing the #BabbleLoader, which is an "extremely evasive loader, packed with defensive mechanisms that is designed to bypass antivirus and sandbox environments to deliver stealers into memory". There is a TON of analysis and intel here, so I am going to try and highlight the parts that I find significant and actionable! Defense Evasion: - The malware checks the installed graphics adapters to see if it is running in a sandboxed environment or not. This leverages the dxgi.dll which is the DirectX Graphics Infrastructure library. - It checks the amount of unique running processes in the machine by calling NtQuerySystemInformation. The magic number is 85 unique processes with the assumption that a true infected computer would have more running processes that a sandbox would. Next Stage: - The next stage involves a Donut loader which, according the the GitHub README states: "Donut?is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.[1]" - The ultimate payload in these examples were WhiteSnake and Meduza Stealers. Hunt opportunity: In this case, because the Donut loader and other payloads involved use command and control as their communication, there is an opportunity to run an unstructured hunt for "new" or anomalous connections. The article also mentioned that the WhiteSnake stealer uses the TOR network for C2 which would involve the installation on the victim's machine, which is another opportunity to find something suspicious. Well, I am SURE there is plenty of information that is critical to everyone else BUT that is why it is time for you to read it for yourself! Enjoy and Happy Hunting! Babble Babble Babble Babble Babble Babble BabbleLoader https://lnkd.in/gQPHjNzA Supplemental [1]: GitHub/TheWover/Donut https://lnkd.in/gUUNeGix Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471

?? I’m proud to be part of a company that genuinely supports our reserve employees, standing by them with unwavering encouragement and providing equal opportunities for growth. ??? At our core, we believe in fostering an environment where everyone, regardless of their background or commitments, has the same opportunities to succeed. It’s this spirit of inclusivity and respect that truly sets us apart.? Grateful to work alongside a team that lives these values every day. ???? Intezer ?????? ???????????? #SupportOurReserves #EqualOpportunities #InclusiveWorkplace??