1/ #ThreatHunting
AnyDesk
Splashtop
Atera
TeamViewer
SupRemo
ScreenConnect
Remote Utilities
After breaching a network, attackers install, besides the obvious backdoors, other (legitimate) remote desktop products that can be used to re-enter the network. 🧵
#CyberSecurity
AnyDesk
Splashtop
Atera
TeamViewer
SupRemo
ScreenConnect
Remote Utilities
After breaching a network, attackers install, besides the obvious backdoors, other (legitimate) remote desktop products that can be used to re-enter the network. 🧵
#CyberSecurity
2/ The list above is not exhaustive, but defenders and incident responders must make sure that the installed remote desktop products were installed by the customer and not by an attacker.
3/ Especially in the case of an IR investigation, it is imperative to hunt for these products in the network.
But also proactively during a compromise assessment - the credentials for the remote solution could also have been leaked on a private PC (-> if possible, use MFA).
But also proactively during a compromise assessment - the credentials for the remote solution could also have been leaked on a private PC (-> if possible, use MFA).
4/ Hunting for these installations can be done in various ways:
- AutoRuns analysis
- Investigating the network connections on the firewall or directly on the hosts
- Inside the event logs, e.g. for new service installations or in the Windows Firewall event logs (new rule)
- AutoRuns analysis
- Investigating the network connections on the firewall or directly on the hosts
- Inside the event logs, e.g. for new service installations or in the Windows Firewall event logs (new rule)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
