What MUNINN finds
MUNINN finds a wide spectrum of cyber threats ranging from simple or severe software and network vulnerabilities, to abnormal user behavior to advanced persistent threats (APT) over longer periods of time. Examples are:
- Abnormal user behavior, such as data breaches and exfiltration from within a network, e.g. large file transfers to a remote server
- Access to a database server and other services outside normal working hours
- Newly introduced services in the network, e.g. an SMTP or FTP file server
- Botnets, malware
- Tor activity and communication through dark nets
- APT, including remote access toolkits communicating with foreign command and control entities over time.
Threats do often consist of some malware or ransomware that gets installed on a device and spreads itself from there, which could involve lateral movement, command & control, data exfiltration and more. The following sections describe in further details how MUNINN detects these threats.
Command and Control (C2 / C&C) activity
When malware has infected a machine, it needs to know what to do next, this means it has a command and control server it connects with to get new orders. MUNINN detects this type of activity by checking connections for known IOC in available Threat Intelligence and using its sophisticated dyadic Machine Learning engine to detect if a connection is normal compared to the automatic created baseline.
Lateral movement and execution
After an attacker has entered your network, they want to get to the right data, this is done by moving from machine to machine until they find the right credentials and access. This type of activity is known as lateral movement, and is something MUNINN will find, by looking both at common attack indicators, such as files written to administrative shares and remote execution over WMI. Besides these standard attack indicators, MUNINN also uses its AI to detect these types of attacks, by looking at activity happening outside of normal business hours, or interaction between machines which normally doesn’t communicate.
Ransomware
MUNINN will detect types of ransomware which infects other devices over the internal network. Using ML & AI, MUNINN will notice unusual activity in the network, both because it will be machines which normally don’t communicate using these kinds of protocols and services.
Exfiltration of data
Today company now has no unimportant data, due to GDPR exfiltration of data is now more severe and costly than ever. In the case where an attacker has gained access to the network, they will try and gain as much value as possible from the hack. One of these actions is exfiltration of all kinds of data, which can be anything from customer information, HR data and confidential cooperate documents. Using AI & Machine Learning MUNINN already has a baseline of how every single machine on the network normally behaves. So, if an employee starts to extract more data than, is normally required by their job, MUNINN will create a notification about this.
Malicious insider threat
The insider threat is one of the most difficult types of threats to detect. Often the person which tries to steal from the company will keep within her normal work pattern most of the time. However, as MUNINN is constantly learning and adapting to the network, it will detect these small deviations from normal, whether it is an employee which is active outside of their normal hours, or if it is a system administrator gone rogue.
