In the technical white paper, we first dive deep at the source code level to share the details of the spreading techniques which has actively been used by the worms. The paper then discusses the static breadcrumbs or lures which is used to detect and divert these multi-stage attack to the deception platform. The technical paper also introduces dynamic breadcrumbs. Dynamic breadcrumbs are the values which get projected in real time when a process is declared to be malicious. It is a definite manner of diverting a multistage threat to a deception platform.
In future, we expect to see more and more threats which will be multistage and will make of spreading techniques. Deception centric architecture is a powerful architecture to not only detect an attack but also gather every malicious indicator of an attack. Identification of every malicious indicator of attack will then aid to identify the threat actors, and the IoC’s can be used to quarantine the infected machines.
Download technical white paper here: Spreading Techniques and Deception-based Detection – Acalvio Technical White Paper.
References:
[1] Shamoon
[2] WannaCry
[3] Recent Resurgence in Shamoon
[4] New ransomware, old techniques: Petya adds worm capabilities
[5] Google says the fake Google Doc worm that went viral affected fewer than 0.1% of Gmail users,