XDR round-up 2023: High-severity threats on the rise, peak during holidays

Top XDR detections in 2023 center on identity abuse

The majority of the top 10 detections of 2023 focus on some kind of identity compromise, resulting in a breached account. The detections that signpost this identity abuse include suspicious logins, brute force attacks, and attackers disabling multifactor authentication.

The uploading of a suspicious executable file could indicate attackers trying to move additional tools. It could also be malware from an external, adversary-controlled system such as a command-and-control server into a compromised account.

Endpoint threat detections involve a mechanism that triggers when Barracuda’s Managed XDR Endpoint Security spots a potential threat within a system. This is regardless of whether it successfully neutralized the threat or not. It’s crucial to promptly notify the client in either scenario. Such detections necessitate a deeper investigation to uncover how the malicious file or process managed to execute initially.

This detection rule covers a wide spectrum of threats, including but not limited to harmless elements, potentially unwanted applications (PUA), adware, spyware, downloaders, cryptominers, malicious documents, exploits, viruses, worms, Trojans, backdoors, rootkits, information stealers, ransomware, interactive or remote shells, lateral movements, and more. Each category requires a tailored approach for effective identification and mitigation.

Suspicious superheroes, ghosts, and insomniacs — how AI tools spot intruders

Barracuda XDR features AI-powered detection rules. Our machine learning capabilities drive it, designed to spot suspicious login activity that requires urgent evaluation. The rules rely on algorithms and AI-based pattern analysis. This models a user’s baseline routine and immediately red flag anything that falls outside that.

Suspicious superheroes — Impossible Travel detection rule

This detection rule catches attackers trying to log into a compromised account. When two logins are detected more than 1,000 km apart and the user would need to be travelling at more than 800 km/h — the average speed of an airplane — in order to do this, a security red flag is triggered. Furthermore, the detection checks the login isn’t associated with a VPN IP to remove any risk of a false positive.

To illustrate how this looks in practice, in one instance Barracuda XDR spotted a user logging in from Iowa in the U.S. and then in Moscow just over an hour later, seemingly covering 8,267 km at a speed of more than 7,000 km/hour.

Ghosts — Rare User Log-in detection rule

This detection rule looks for unusual usernames appearing in the authentication logs. This helps to spot an intruder abusing the credentials for a dormant or inactive user. This could be perhaps because the user has left the organization, or a username that falls out of the organization naming schema. Threat actors will also try to create new users as a means of persistence. The detection rule will flag this as an unknown user.

Insomniacs — Rare Hour for User detection rule

This detection rule looks for a user logging in at a time of day that is unusual for them. This can be due to someone in a different time zone trying to access the compromised account. In addition, unauthorized user activity often takes place outside standard business hours.

Network traffic detections

Barracuda XDR includes a sophisticated, multilayered Intrusion Detection System (IDS). It scrutinizes traffic traversing a client’s network via a SPAN (mirror) port. This IDS serves as a vigilant guardian, pinpointing both suspicious and potentially harmful activities that might appear legitimate but are linked to recognized malware, cyberattacks, and various security threats permeating your network. A significant portion of these threats are automated, executed en masse against networks.

Analysis of the leading IDS detections in 2023 reveals a persistent trend. Attackers consistently exploit longstanding critical vulnerabilities and weaknesses that organizations have yet to address through patching. This highlights the critical need for continuous vigilance and updates to network security measures.

Shellshock is a 10-year-old collection of bugs that continues to rank among the top 10 detections detected by Barracuda’s integrated IDS. The fact that Shellshock attacks remain so prevalent suggests that attackers know there are still many unpatched systems out there. Reports suggest that Shellshock is being used by attackers to launch distributed denial of service (DDoS) attacks. It is also targeting vulnerable interconnected systems using bots and botnets.

Two years after the Log4Shell vulnerability in the open-source Java-based Log4j logging utility was disclosed, exploits against the bug also remain common. This could reflect the fact that Log4j is so deeply embedded in applications and other software that many organizations may not even know it is there. Vulnerable instances could be tricky and time-consuming to mitigate.

How to stay safe in a world of 24/7 attacks

The security basics are more critical than ever. These should include robust authentication and access controls (multifactor authentication at a minimum and ideally moving to Zero Trust- based measures), a solid approach to patch management and data protection, and regular cybersecurity awareness training for employees.

However, in the face of a growing number of high-severity threats targeting an organization’s expanding digital attack surface, and as attackers increasingly start to leverage AI for ever more sophisticated, faster, and targeted attacks, defenders will need to ensure their security tools have the same power. A multi-faceted, AI-based approach to protection that has several levels of increasingly deep detection and scrutiny is essential.

This should sit within an overall security framework that comprises robust next-generation security technologies, backed by expert analysis and 24/7/365 security monitoring to catch unknowns and anomalies that might otherwise slip through the net — and a SOC as a service to respond to and mitigate threats.

If you don’t have the time or expertise in-house, a managed XDR service that includes a SOC as a service can keep watch over every corner of your IT environment for you, all day, every day.

The findings are based on detection data from Barracuda XDR, an extended visibility, detection, and response (XDR) platform, backed by a 24×7 security operations center (SOC) that provides customers with round-the-clock human and AI-led threat detection, analysis, incident response, and mitigation services. 

Photo: everything possible / Shutterstock