1. Intercept X Early Access Program Root Cause Analysis
Stephen McKay
Product Manager – Endpoint Security Group
May 2018

2. So the Endpoint found and removed malware.. What happened?
Where did it get in? Should we contact a Regulator? “
What damage has been done? Did they steal important data? “
When?
How?
Who?
Where?
What?
Why?

3. Understanding the Root Cause of attack
Sophos Data Recorder
Operating Systems
Windows 7+
Windows 2008R2+
macOS
Capacity
Up to 30 days of activity
100 MB
Local to the device
Under 0.5% CPU utilization
Memory
Registry
Network
File system
Process activity

4. Datacollector.exe Created
Branched Threat Chains – Threat Chain includes suspect activity related to the root cause
Process Activity
At Risk Assets – Identification of all productivity documents related to the complete threat chain
Written by iExplore.exe
From URL fred.com
Datacollector.exe Created
Copied from USB device
Fred.pdf created
Low rep site
Accessed via acrobat.exe
Fred.com accessed
Written by iExplore.exe
From URL fred.com
Bob.exe Created
Bob.exe reached out to C2 site
HIPS cleaned Bob.exe
File Infection
Event
Time
Root Cause Attribution–
PDF delivered from USB
Recommended Action– Leverage Device Control
Threat Chain –
full list of IOCs from the Sophos Data Recorder including process, registry, file, network activity
Timeline of events –
View the chain of events from root cause to detection, filter out unrelated activities.
Beacon Event
Exploit
Malicious Traffic
Ransomware
File analytics
HIPS
Scan

5. Main landing page Archive of all RCA cases
Provides a list of all RCA Cases
RCA in the Server Protection area defaults to show Server RCA cases, you can change the view to show Endpoint RCA cases or All RCA cases
Priority is determined algorithmically and can be set by a reviewer
See the detection that triggered the RCA Case generation
An RCA Case should be available about 5 min after the detection event

6. Overview Page Overview and activity record
Summary showing identified Root Cause application
Have business files been interacted with during the attack
Admin can mark the case as in-progress, or closed
Admin can change the priority based on their investigation
Activity Records
Allows administrators to take notes on the case and document actions taken

7. Artifacts View all associated artifacts
List of all process, file, registry and network activity involved
Excludes processes and actions not associated with the attack
Details provide additional information on each artifact
Search and sort to see details

8. Visualization See what happened and how
Provides a process graph showing the chain of events that lead to the detection
Processes and actions not associated with the attack are not included
Understand the type of interaction between processes, files, network and registry
Turn on or off visualization of various indicators
Selecting a node on the graph provides additional details