Blog
How Breach & Attack Simulation Tools Can Help You Prepare for Ransomware Attacks
Read More
Defending the enterprise amid the ever-evolving threat landscape has prompted security teams to deploy numerous security controls and processes in the quest to prevent business-crippling cyberattacks. CISOs and security teams are constantly trying to maximize the impact of their security controls and proactively manage their risk and security posture. Yet, teams struggle to understand if the many controls deployed are configured correctly, which controls will prevent, detect, or completely miss an attack, and how the controls will work together against threat groups that pose a risk to the business.
SafeBreach offers continuous security validation, powered by its breach and attack simulation (BAS) platform, designed to help organizations overcome this challenge. The platform safely executes real-world attack simulations across the cyber kill chain to validate the effectiveness of all layers of your security independently and at each stage of the attack process to strengthen cyber resiliency. One of the primary drivers behind our ability to provide relevant, comprehensive, and timely threat intelligence that emulates real attacker techniques is our SafeBreach Labs team.
The SafeBreach Labs team is composed of cybersecurity experts who spend their time scouring intelligence feeds and conducting original research to provide offensive insights into the latest and most relevant threats. Their ability to vigilantly monitor for exploits and attacks allows SafeBreach to offer the industry’s largest and most comprehensive attack playbook with over 25,000 attacks and the only 24-hour SLA on incorporating the latest actionable TTPs and IOCs from US-CERT, FBI Flash, and other critical alerts.
The SafeBreach Labs team actively contributes to the global cybersecurity community, partners with leading security control vendors to optimize and and improve their products, and openly shares their research at leading conferences like Black Hat, RSA, and DEF CON. The Labs team is also an active contributor to the MITRE ATT&CK® framework. The latest example of this original research and partnering with a security vendor is the discovery of a potentially exploitable generic bypass in the Cortex XDR agent’s Anti-Ransomware Protection module by Itay Migdal, a SafeBreach Labs researcher.
Due to his passion for threat intelligence, malware analysis, and red teaming, Itay was able to discover that a non-admin Windows user could leverage this bypass to reduce the overall effectiveness of the Anti-Ransomware Protection module. This discovery was immediately reported to Palo Alto Networks, and they released advisory PAN-SA-2022-003 to warn and protect any customers using the Cortex XDR agents with a content update earlier than CU-610.
It is important to note that if this discovery had been made by malicious threat actors, they could have leveraged it to affect millions of Cortex XDR agents around the world. Due to this risk, we have decided not to share the technical details of this bypass at this time as a precautionary measure for unpatched XDR agents.
Congratulations Itay Migdal and the SafeBreach Labs team for their commitment to ensuring organizational security–one exploit, TTP, and IOC at a time!
Additional SafeBreach Labs Resources:
- SafeBreach Labs Page
- US-CERT, FBI Flash Related Coverage
- Original Threat Research
- FORGET ZERO TRUST: AIM TO “CONTROL THE CONTROLLABLES”
- hAFL1: Our Journey of Fuzzing Hyper-V and Discovering a 0-Day
- DEF CON 29 – Tomer Bar, Eran Segal – 2021 Our Journey Back To The Future Of Windows Vulnerabilities
- DEF CON Safe Mode – Peleg Hadar and Tomer Bar – After Stuxnet Printing still the Stairway to Heaven
- SafeBreach Labs – GitHub