Intercept X Early Access Program Root Cause Analysis Stephen McKay Product Manager – Endpoint Security Group May 2018

So the Endpoint found and removed malware.. What happened? Where did it get in? Should we contact a Regulator? “ What damage has been done? Did they steal important data? “ When? How? Who? Where? What? Why?

Understanding the Root Cause of attack Sophos Data Recorder Operating Systems Windows 7+ Windows 2008R2+ macOS Capacity Up to 30 days of activity 100 MB Local to the device Under 0.5% CPU utilization Memory Registry Network File system Process activity

Datacollector.exe Created Branched Threat Chains – Threat Chain includes suspect activity related to the root cause Process Activity At Risk Assets – Identification of all productivity documents related to the complete threat chain Written by iExplore.exe From URL fred.com Datacollector.exe Created Copied from USB device Fred.pdf created Low rep site Accessed via acrobat.exe Fred.com accessed Written by iExplore.exe From URL fred.com Bob.exe Created Bob.exe reached out to C2 site HIPS cleaned Bob.exe File Infection Event Time Root Cause Attribution– PDF delivered from USB Recommended Action– Leverage Device Control Threat Chain – full list of IOCs from the Sophos Data Recorder including process, registry, file, network activity Timeline of events – View the chain of events from root cause to detection, filter out unrelated activities. Beacon Event Exploit Malicious Traffic Ransomware File analytics HIPS Scan

Main landing page Archive of all RCA cases Provides a list of all RCA Cases RCA in the Server Protection area defaults to show Server RCA cases, you can change the view to show Endpoint RCA cases or All RCA cases Priority is determined algorithmically and can be set by a reviewer See the detection that triggered the RCA Case generation An RCA Case should be available about 5 min after the detection event

Overview Page Overview and activity record Summary showing identified Root Cause application Have business files been interacted with during the attack Admin can mark the case as in-progress, or closed Admin can change the priority based on their investigation Activity Records Allows administrators to take notes on the case and document actions taken

Artifacts View all associated artifacts List of all process, file, registry and network activity involved Excludes processes and actions not associated with the attack Details provide additional information on each artifact Search and sort to see details

Visualization See what happened and how Provides a process graph showing the chain of events that lead to the detection Processes and actions not associated with the attack are not included Understand the type of interaction between processes, files, network and registry Turn on or off visualization of various indicators Selecting a node on the graph provides additional details