GreyNoise launches Tactics to map post-compromise attacker activity on Deception Sensors to MITRE ATT&CK
GreyNoise announced Tactics, a new feature in the GreyNoise Visualizer (Observe → Tactics) that maps attacker sessions captured by GreyNoise Deception Sensors to the MITRE ATT&CK framework. It extends the company's visibility beyond Reconnaissance and Initial Access, following the earlier C2 Detection Module, to show what adversaries do after gaining a shell. The feature is available to all users with a deployed sensor, including Project Swarm participants. GreyNoise also published a research report, After the Shell, based on weeks of post-compromise activity on its own sensor network. It found mostly commodity cryptomining, plus a smaller set of sessions involving cloud credential theft, container escape attempts and backdoor account creation.
Detalhes técnicos
- Each detection represents one qualifying session. It shows the observed tactics and techniques, the full command sequence, executed commands, scripts and binaries, files created or modified (with SHA256 hashes), outbound connections and lateral movement attempts.
- Tactics only populates once an attacker compromises a vulnerable sensor profile and performs activity mapped to an ATT&CK technique. Routine and unclassified sessions are filtered out.
- Covered stages: Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.
- Observed behaviors in the research: commodity cryptomining, searches for cloud credentials, container escape attempts and backdoor account creation.
Remediação
- This is a product announcement, not a vulnerability, so no remediation is required.
- Defenders can use the captured commands, hashes, file paths and binaries to build detections and hunt in production environments.
- Teams can deploy a GreyNoise Deception Sensor via Project Swarm to begin collecting this telemetry.
Linha do tempo
-
GreyNoise launches Tactics to map post-compromise attacker activity on Deception Sensors to MITRE ATT&CK
ler a análise desta fonte ocultar
GreyNoise announced Tactics, a new feature in the GreyNoise Visualizer (Observe → Tactics) that maps attacker sessions captured by GreyNoise Deception Sensors to the MITRE ATT&CK framework. It extends the company's visibility beyond Reconnaissance and Initial Access, following the earlier C2 Detection Module, to show what adversaries do after gaining a shell. The feature is available to all users with a deployed sensor, including Project Swarm participants. GreyNoise also published a research report, After the Shell, based on weeks of post-compromise activity on its own sensor network. It found mostly commodity cryptomining, plus a smaller set of sessions involving cloud credential theft, container escape attempts and backdoor account creation.
Technical Details
- Each detection represents one qualifying session. It shows the observed tactics and techniques, the full command sequence, executed commands, scripts and binaries, files created or modified (with SHA256 hashes), outbound connections and lateral movement attempts.
- Tactics only populates once an attacker compromises a vulnerable sensor profile and performs activity mapped to an ATT&CK technique. Routine and unclassified sessions are filtered out.
- Covered stages: Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.
- Observed behaviors in the research: commodity cryptomining, searches for cloud credentials, container escape attempts and backdoor account creation.
Remediation
- This is a product announcement, not a vulnerability, so no remediation is required.
- Defenders can use the captured commands, hashes, file paths and binaries to build detections and hunt in production environments.
- Teams can deploy a GreyNoise Deception Sensor via Project Swarm to begin collecting this telemetry.