Blog: RSA Research & Innovation

Innovating ahead of the market and offering the latest threat intelligence on the ever-expanding attack surface.

  • 7/28/2017 - Operational Rhythm at the Black Hat 2017 NOC By Matt Tharp Operational rhythm is the term for the nebulous flow of information between parts of a team that makes it so effective. Who needs what, and when to be successful? In the Black Hat NOC, we have very little time to establish such a rhythm. However, a process for distributing critical information isn’t...
  • 7/25/2017 - Black Hat NOC 2017: CAN YOUR SIEM DO THIS? Setup of the Black Hat NOC is an exciting time. The entire network infrastructure is dropped in place at Mandalay Bay. Multiple Black Hat NOC teams work long hours to get the network in place, configured and tested. The attention then turns to the NOC setup where the infrastructure is tied together. RSA, one of...
  • 7/18/2017 - Demand More from Your SIEM By Mike Adler, VP Product, NetWitness Suite If you’re like a lot of IT security professionals, you’ve always been able to rely on your SIEM to provide log data for threat detection. But that’s just not enough to keep up with all the new threats from new sources that are bombarding organizations today. Can your...
  • 7/17/2017 - Hypothesis in Threat Hunting Today’s threat landscape requires organizations to operate more proactively to keep up with advanced and persistent threats. There is no doubt that the practice of threat hunting has emerged as a key capability to detect stealthy threat actors trying to gain access to the organizational IT infrastructure by evading traditional security measures. Hunting aims to...
  • 7/5/2017 - Cat-Phishing Hackers for Fun and Profit On June 14th, 2017, a new variant of ZXShell appears to have been uploaded from the Marmara region of Turkey. The Trojan itself is well known and contained x32 and x64 rootkits. This blog describes the functionality of ZXShell, as well as the associate rootkits. The Trojan source code is available here. Metadata File Name:...
  • 6/28/2017 - Detecting "Petya/NotPetya" with RSA NetWitness Endpoint and RSA NetWitness Packets By Alex Cox, Christopher Elisan and Erik Heuser, RSA Research A Ransomware variant known as “Petya/NotPetya” began making the rounds on June 27, 2017. This ransomware takes a different approach to denying access to the victim’s files. Instead of the usual displaying of a message and letting the victim browse to really see that the...
  • 6/5/2017 - Shadowfall Over the last several months, RSA Research embarked on a cross-organizational effort against RIG Exploit Kit (RIG EK or just plain RIG), which led to insight into the operational infrastructure (and possibly the entire ecosystem), as well as significant discoveries related to domain shadowing. Domain shadowing is “a technique in which attackers steal domain account...
  • 5/19/2017 - What Really Led to WannaCry? Much of the focus on WannaCry has been on how it works and what organizations need to do in the near term to recover. It’s important, however, to take a step back and ask ourselves why WannaCry became such a tour-de-force in the first place. After all, the security community has been talking about concepts...
  • 5/10/2017 - How Ransomware uses TMP files and the Temp folder In my previous blog, Why Malware Installers Use TMP files and the Temp folder, I discussed the advantages malware can have by using atomic writes instead of simply copying the malware to the intended location. In this blog, I discuss how ransomware uses the same technique for its purpose and how it is different from...
  • 5/3/2017 - SuperCMD RAT On April 8th, an interesting DLL was uploaded from Canada to VirusTotal. What makes it interesting is that the detections on VirusTotal are mostly heuristics and do not settle on a single family. The malware is also configured to beacon to an RFC1918 internal IP address, however, the name 816db8a1916201309d2a24b4a745305b.virus indicates it was picked up...