WEBVTT
00:00:00.160 --> 00:00:06.320
Welcome to the Talos Takes Podcast, where we discuss Talos' latest research and security news.
00:00:06.320 --> 00:00:10.800
This podcast is for everyone, from the C suite to the front lines.
00:00:10.800 --> 00:00:15.919
Hello, everyone, and welcome to Talos Takes.
00:00:15.919 --> 00:00:18.079
I'm your host, Amy Ciminnisi.
00:00:18.079 --> 00:00:28.559
Today is a very exciting episode for me because we are examining a real incident that Talos Incident Response faced last quarter.
00:00:28.559 --> 00:00:39.200
It impacted an Australian medical center, and it really shows how attackers are bypassing defenses by operating entirely within the cloud.
00:00:39.200 --> 00:00:41.679
We are going to discuss a few things.
00:00:41.679 --> 00:00:45.200
First, the rise of QR-based phish.
00:00:45.200 --> 00:00:49.200
Second, the challenges of securing non-corporate devices.
00:00:49.200 --> 00:00:55.280
And three, the human impact of defending these high-stakes environments.
00:00:55.280 --> 00:01:01.280
So joining me to walk through the investigation is senior incident response consultant Terryn Valikodath.
00:01:02.320 --> 00:01:03.759
How are you doing?
00:01:04.159 --> 00:01:04.959
I'm doing well.
00:01:04.959 --> 00:01:06.000
How about yourself?
00:01:06.000 --> 00:01:09.680
It's been a little bit since I've been on here, but I'm glad to be back.
00:01:10.000 --> 00:01:10.560
I know.
00:01:10.560 --> 00:01:12.480
I'm very glad to have you back.
00:01:12.480 --> 00:01:19.439
Uh, listeners, you may know Terryn from an episode of Humans of Talos that we released several months back.
00:01:19.439 --> 00:01:29.519
Um, if you want to learn more about his background, uh his love for dinosaur bones and forensic anthropology, uh, go right ahead.
00:01:29.519 --> 00:01:30.959
Go check that out.
00:01:30.959 --> 00:01:31.519
Okay.
00:01:31.519 --> 00:01:33.760
So, Terryn, let's get into this.
00:01:33.760 --> 00:01:36.400
You worked on this incident yourself, right?
00:01:36.799 --> 00:01:37.599
Yes, that's correct.
00:01:37.599 --> 00:01:37.920
Yep.
00:01:37.920 --> 00:01:40.560
I was a part of it, the entire length of it.
00:01:40.959 --> 00:01:41.359
Wow.
00:01:41.359 --> 00:01:57.120
I I feel like one of the most interesting things to me about this incident is that it is involving, you know, a medical center where the stakes are higher than, you know, a typical corporate environment, right?
00:01:57.120 --> 00:01:59.519
Because people's lives can be on the line.
00:01:59.519 --> 00:02:09.840
Um, when you join that initial call, how do you like manage the tension and pressure of knowing that an incident here could impact patient care?
00:02:10.400 --> 00:02:24.560
Yeah, no, it's a it's a huge kind of undertaking to realize sometimes that what's going to happen could actually impact things to that degree, um, especially having someone, uh, my wife that actually works in healthcare as well.
00:02:24.560 --> 00:02:28.639
They know it too far too well of how much that can be a disruption.
00:02:28.639 --> 00:02:32.319
Um, but realistically, I I don't think it changes too much.
00:02:32.319 --> 00:02:43.520
Um, I think it really is about just making sure that you kind of remain even more calm and collected because oftentimes the people that we're working with, they don't have that luxury.
00:02:43.520 --> 00:02:49.280
So we need to make sure that we can for them and kind of explain exactly what we're going to do.
00:02:49.280 --> 00:03:07.039
And when we're talking about medical, I think it really comes down to understanding um impact, like what is truly going to be impacted, and knowing that there might be things that they just cannot risk, that they might need to make decisions that maybe a different enterprise would say, no, let's hold off on that.
00:03:07.039 --> 00:03:09.919
But for them, it's critical and they need to take that risk.
00:03:09.919 --> 00:03:19.120
So being very thorough about what exactly you're finding and giving clear recommendations and alternatives, um, I think is is really what comes up in those types of cases.
00:03:19.439 --> 00:03:28.879
Um, and so in this case specifically, there was a very specific, highly personalized lure uh that kind of opened the door to compromise.
00:03:28.879 --> 00:03:35.039
Can you walk us through, you know, what did that initial email to the employee look like?
00:03:35.039 --> 00:03:40.479
Uh, how how was it able to bypass those typical red flags that we are trained to look for?
00:03:40.879 --> 00:03:41.199
Yeah.
00:03:41.199 --> 00:03:47.599
Um, so the email was a little bit different because it came in as a phishing email that I'm sure everyone is familiar with.
00:03:47.599 --> 00:03:53.840
Um, it pretended to be um a payroll adjustment, so to capture kind of the employee's attention right away.
00:03:53.840 --> 00:03:59.199
Um, but the unique thing was that it had a PDF attachment, which is also not unusual.
00:03:59.199 --> 00:04:03.280
But within the PDF was actually where we see the QR code.
00:04:03.280 --> 00:04:10.159
And that's where it kind of changes things up a little bit because when you see a QR code, people naturally want to scan it.
00:04:10.159 --> 00:04:14.719
And you're not scanning it with the device you're using, you're scanning it with a mobile device.
00:04:14.879 --> 00:04:15.039
Yeah.
00:04:15.199 --> 00:04:23.839
Um, so what happens in that case is the user scans it with their mobile device, they get the fake login page like we see over and over again.
00:04:23.839 --> 00:04:31.360
But the problem being it's on a device that doesn't have the same protections, uh, that's not as visible to the organization.
00:04:31.360 --> 00:04:38.639
So when they put in those credentials into that page, uh, everything is kind of happening almost offline.
00:04:38.639 --> 00:04:45.920
Uh so it presents a much bigger challenge uh because the adversary on the other side, they're kind of using that information live.
00:04:45.920 --> 00:04:48.879
They're taking those logins, trying to log in directly.
00:04:48.879 --> 00:04:52.879
That's going to maybe prompt MFA for the user, which they would expect.
00:04:52.879 --> 00:04:54.160
They just put credentials in.
00:04:54.160 --> 00:04:57.120
So it looks very normal from their standpoint.
00:04:57.120 --> 00:05:04.240
So when you lack the visibility from an organization security standpoint, you would have no idea.
00:05:04.240 --> 00:05:11.360
Um, it's just something that kind of happens completely offline, but from the attacker perspective, you know, it's everything they would need to get in.
00:05:11.360 --> 00:05:16.160
Um, and the victim just is completely unaware, uh, all because it's on a separate device.
00:05:16.480 --> 00:05:25.519
I'm curious how we need to change how we're thinking about like corporate owned versus personal device security.
00:05:25.519 --> 00:05:34.000
Like, obviously, uh, you know, you can't put all of these security controls on people's personal devices who are your employees.
00:05:34.000 --> 00:05:37.279
Um wow, big issue.
00:05:37.279 --> 00:05:46.160
Um, but like what can we do to try and like mitigate that risk that the situation present presents?
00:05:46.560 --> 00:05:58.160
Yeah, I think it's it really comes down to like, like you said, it's it's not a feasible task, in my opinion, to be able to get only provide phones that belongs to organizations that have these protections.
00:05:58.160 --> 00:06:04.720
And even when we're talking about phones in general, uh, we just can't see it the same way we would see a Windows laptop.
00:06:04.720 --> 00:06:10.480
So even if we did have that, I don't know if it would really change too much in terms of what you can change and do.
00:06:10.480 --> 00:06:15.759
Um, but I think a lot of it really just come down to the simple answer of just educating people.
00:06:15.759 --> 00:06:20.079
Like when you see a QR code via PDF, like that's probably something you shouldn't scan.
00:06:20.079 --> 00:06:29.120
Or like if you're going to interact with anything that's asking for you to log in, make sure it's on those kind of approved devices or going through a certain method.
00:06:29.120 --> 00:06:32.319
Um, it's a really tough situation to kind of get around.
00:06:32.319 --> 00:06:41.759
I think it's one of those avenues that clearly shows threat actors are just getting more and more savvy by just kind of taking advantage of how we do our everyday life.
00:06:41.759 --> 00:06:47.279
It's not like they're doing some crazy exploit or doing some ultra-technical task.
00:06:47.279 --> 00:06:53.920
Uh, it's really just watching, observing how people do their day-to-day and then seeing where they can kind of insert themselves.
00:06:53.920 --> 00:06:56.000
Uh, so there's unfortunately not an easy answer.
00:06:56.000 --> 00:07:04.160
I think it's really just uh a matter of educating, hopefully, like we are now, so you know that these types of things can occur and what they could potentially lead to.
00:07:04.480 --> 00:07:14.720
As an incident responder, this QR code phishing, we have put out like a few different articles and such about it over the years.
00:07:14.720 --> 00:07:19.279
Um, but like how how often do you see that pop up in your incidents?
00:07:19.279 --> 00:07:23.600
Is it often, is this kind of the first case in a while that you've seen?
00:07:23.600 --> 00:07:27.519
Um, and how how prevalent is it really that we know of?
00:07:27.839 --> 00:07:32.319
Yeah, I would say it's pretty recent that it's becoming more notable.
00:07:32.319 --> 00:07:44.959
Um, I'll admit, like maybe five years ago, the the idea of QR code phishing was kind of like this anomaly, even for myself, of like, yeah, sure, it's technically possible, but how would that actually be done?
00:07:44.959 --> 00:07:45.279
Yeah.
00:07:45.279 --> 00:07:49.519
Uh, but now we're kind of seeing, like, yes, it can clearly still be done.
00:07:49.519 --> 00:07:52.480
Um, and that inherent trust is still there.
00:07:52.480 --> 00:08:01.120
And I think the the difficulty and the scary part is if it happens, you won't necessarily know what's happening unless you're talking with the user.
00:08:01.120 --> 00:08:05.199
You can kind of do that comparison, you can look at those emails yourself.
00:08:05.199 --> 00:08:08.560
So, yeah, it's definitely something more recent, I would say.
00:08:08.560 --> 00:08:24.319
Um, it definitely was not top of the radar before like it is now, but now I think it's clearly shown that um it can still work um and it can lead to some pretty crazy stuff, even though uh it's relatively simple and it might be one of those things that people scoff at when they first hear about it.
00:08:24.639 --> 00:08:29.759
Yeah, adding that into your employee training is just so necessary now.
00:08:30.079 --> 00:08:30.399
Yeah.
00:08:30.399 --> 00:08:39.759
Yeah, and I think also a point to anyone that's doing those education trainings, being able to show what it can lead to, I think is a really good way to emphasize it.
00:08:39.759 --> 00:08:56.399
Because everybody knows phishing exists, but I think until you kind of put into the frame of what can happen as a result of your account being compromised, um, is a is a good way to put it forward rather than folks just kind of assuming that, oh, they don't need my data, so they're not gonna go after me.
00:08:56.399 --> 00:08:59.200
That's not really what it's about in a lot of these cases.
00:08:59.679 --> 00:09:00.480
100%.
00:09:00.480 --> 00:09:01.440
Yeah.
00:09:01.440 --> 00:09:02.080
Okay.
00:09:02.080 --> 00:09:09.600
So let's talk about um how this kind of took place within Microsoft uh cloud products, right?
00:09:09.600 --> 00:09:14.159
Nothing ever touched, you know, an internal workstation or a server.
00:09:14.159 --> 00:09:20.320
Um can you kind of talk about that and what that means for like hunting for evidence?
00:09:21.039 --> 00:09:21.919
Yeah, absolutely.
00:09:21.919 --> 00:09:29.840
So in this case, what we saw is as soon as they got those credentials, they they logged in using that user's information.
00:09:29.840 --> 00:09:36.639
Um, and from that point, um, all they really did was go into things like SharePoint.
00:09:36.639 --> 00:09:46.559
Uh we didn't see it, but they could access things like OneDrive or anything else that uh you would kind of work with your day-to-day type of work for documents and things like that.
00:09:46.559 --> 00:10:01.840
Um, but the interesting thing we saw with this is they actually accessed uh SharePoint and they tried to stage one of the SharePoint sites as another phishing link and then invite as many users as they can, from what we can tell.
00:10:01.840 --> 00:10:03.759
I think just their entire contact list.
00:10:03.759 --> 00:10:07.120
So this is internal users and even other companies.
00:10:07.120 --> 00:10:10.399
Um, so they're just blasting this out to as many people as possible.
00:10:10.399 --> 00:10:14.080
Luckily, I think that was blocked, so it didn't get to that point.
00:10:14.080 --> 00:10:25.200
Um, but you can see them kind of trying to do this worming of get into one location, expand out, and just keep going and going and going until they can hit as many as they possibly can.
00:10:25.200 --> 00:10:38.960
Um, but like you said, the the interesting thing is they never touched, you know, a user's desktop, they never accessed someone's server, they never really got into what we would traditionally think of uh of a hack.
00:10:38.960 --> 00:10:46.399
Um they're really just staying within the account, uh within SharePoint, within these Microsoft products that are just all online available.
00:10:46.399 --> 00:10:57.440
Uh so it does introduce some complexities in investigating too, because uh some of these things are not by default set up to show you every little thing that happens.
00:10:57.440 --> 00:11:10.480
Um, so there is a lot more inference you have to make, there's a lot more details you have to kind of extract from different locations rather than something as clear as like a Windows event log that's gonna clearly tell you here's what this user account did from A to B.
00:11:10.480 --> 00:11:18.399
Uh so doing that kind of comparison is becoming more of a skill that we're realizing you need to keep up uh because those things change so often.
00:11:18.399 --> 00:11:22.480
And Microsoft also likes to change, you know, how they log certain things or what they're doing.
00:11:22.480 --> 00:11:27.679
So being on top of what you can actually see uh is half the battle, in my opinion.
00:11:28.320 --> 00:11:39.679
Kind of a recurring theme over the past several Talestakes episodes that I've noted is the idea of bypassing MFA and traditional MFA not always being enough.
00:11:39.679 --> 00:11:52.639
Um you mentioned that we don't have the exact play-by-play of you know the user's screen and you know what they saw, but we do know the outcome that the adversary got in.
00:11:52.639 --> 00:12:00.080
Um what are some of the signs that an adversary is abusing a session in the cloud?
00:12:00.080 --> 00:12:05.519
And you know, what what should teams be looking for in their logs to try and catch this a little bit earlier?
00:12:05.840 --> 00:12:07.279
Yeah, no, great question.
00:12:07.279 --> 00:12:20.399
Um, I think one of the first things we often look for is the sign-ins to see are they suddenly signing in from uh a new country or kind of a new uh range IP range that you wouldn't expect.
00:12:20.399 --> 00:12:24.240
Other things we commonly look for is new devices being registered.
00:12:24.240 --> 00:12:37.200
Uh, one common thing we like we see adversaries like to do is once they get into someone's account to kind of retain that access, they'll register their own phone or a different device that can take the MFA request from that point on.
00:12:37.200 --> 00:12:57.840
And then um uh if you really want to get down to technical details, if you look into uh token usage, um, you can see very clearly in some of the logs that uh when a token is being reissued or it's being reset, or maybe they're using the same one over and over again in different sessions where that isn't typically the case.
00:12:57.840 --> 00:13:02.559
Uh so yeah, a lot of it is coming down to just those anomalies and discrepancies.
00:13:02.559 --> 00:13:08.240
Uh, but I think the biggest challenge you'll have is making sure you have some kind of understanding of what the normal is.
00:13:08.240 --> 00:13:10.480
Where are they typically logging in from?
00:13:10.480 --> 00:13:12.960
You know, do they live in multiple locations?
00:13:12.960 --> 00:13:16.159
Is there a reason a different IP address may pop up?
00:13:16.159 --> 00:13:23.759
Uh so it does take a lot of coordination either with the user themselves or just kind of an understanding of what's going on in the environment.
00:13:23.759 --> 00:13:36.720
So you can clearly show that this is an anomaly because you'll be surprised how many uh uh false positives you'll see just because people use VPNs, people might be untraveling and accessing things on their phone.
00:13:36.720 --> 00:13:44.799
So uh it is definitely a little bit of a game of understanding the common behaviors, and then you can do a better job of looking for those anomalies.
00:13:45.120 --> 00:13:58.320
So once organizations catch that first indicator, um, you know, they look into it, they triage it, um, and determine that it's something that they need to look into and open an incident.
00:13:58.320 --> 00:14:04.159
What are the steps that you take to remediate something like this?
00:14:04.159 --> 00:14:12.240
Um, and how do you know when the environment is sufficiently normal enough to close out the incident?
00:14:12.799 --> 00:14:13.200
Yeah.
00:14:13.200 --> 00:14:31.600
Um, so the first thing I think anytime you see activity like this where someone's account's being compromised is having a very quick way to either disable the account, reset the password, revoke the sessions, which all of that is built into Microsoft tools, so it's not too difficult, but making sure you can do it as fast as possible.
00:14:31.600 --> 00:14:40.960
Um, and I think the next thing that we often run into is being able to provide access to say us or anyone else that's going to help investigate.
00:14:40.960 --> 00:14:46.960
Um, sometimes it's the first time organizations will do this, so they don't have a clear idea of how to provide external access.
00:14:46.960 --> 00:14:51.679
Uh, we of course help out with that, but knowing that ahead of time can certainly speed things up.
00:14:51.679 --> 00:14:56.480
Or if you know, you know, which logs we need to grab, it can extract those ahead of time.
00:14:56.480 --> 00:14:59.200
Those types of steps um go a long way.
00:14:59.200 --> 00:15:09.440
Um, but yeah, really a lot of it is just looking at those discrepancies, um, not being afraid to kind of do a little bit more if you have to, right?
00:15:09.440 --> 00:15:15.919
Um, in some cases we see like this, uh maybe there was multiple users that were involved in that invitation.
00:15:15.919 --> 00:15:17.679
Uh, you might just take that precaution.
00:15:17.679 --> 00:15:19.679
Let's just reset the password for all of them.
00:15:19.679 --> 00:15:27.279
You know, even if we don't see a clear that sign in or some other type of evidence, uh, being able to take those actions is always best.
00:15:27.279 --> 00:15:33.440
I mean, as much as we love to preserve evidence as much as possible, at the end of the day, we want to make sure things don't get worse.
00:15:33.440 --> 00:15:41.919
So we would much rather you take action and we lose a little bit of evidence than waiting too long and things get worse before any action is taken at all.
00:15:42.240 --> 00:15:43.919
Yeah, 100%.
00:15:43.919 --> 00:15:55.039
Um, and I can't help but think about both the IT teams of the organization and also like the person who fell victim to the phishing link.
00:15:55.039 --> 00:16:03.039
I feel like there might be kind of a knee-jerk reaction to blame that person and to assign that blame.
00:16:03.039 --> 00:16:27.840
Um, from your perspective, how do you kind of steer leadership or steer whoever you're communicating with toward kind of more of a blameless and educational culture that focuses on those educational improvements rather than you know pointing fingers at people who didn't know or maybe were a little bit careless in a situation like this.
00:16:28.240 --> 00:16:28.879
Yeah, absolutely.
00:16:28.879 --> 00:16:33.360
Uh yeah, we I don't think you can ever really blame a user in those situations.
00:16:33.360 --> 00:16:41.039
When we're talking about the situation like right here with the QR code, yeah, it's so hard to imagine something like that would even happen.
00:16:41.039 --> 00:16:51.200
Um if you're thinking about your work every day and then something like this occurring, that's not even close to the top of your mind if you're working in accounts payable, HR, wherever else.
00:16:51.200 --> 00:16:55.360
Um, so of course, it's not really their main concern.
00:16:55.360 --> 00:16:58.879
But um, yeah, I think a lot of it is just sharing more.
00:16:58.879 --> 00:17:06.240
I think it really does just come down to just being more upfront about when you see these things even happening in the organization.
00:17:06.240 --> 00:17:18.640
So, example with this one, uh, as soon as we saw this, we asked them, like, hey, is it worth just issuing a communication to the rest of your um organization about, hey, this has happened, watch out for it.
00:17:18.640 --> 00:17:23.279
Just so when you see that, people feel more willing to kind of come up to you and tell you those things.
00:17:23.279 --> 00:17:35.839
Because I'm sure there's situations that happen that just nobody reports, nobody mentions that it's actually occurred until it gets to a point that it feels very uh it feels the need to blame someone.
00:17:36.000 --> 00:17:36.240
Yeah.
00:17:36.799 --> 00:17:43.359
But usually that means there could have been a proactive measure, whether that's just educating people more about what's going on.
00:17:43.359 --> 00:17:50.960
And sometimes it's more about making it more interesting on how you're educating people, because nobody likes doing the annual training sometimes.
00:17:50.960 --> 00:18:17.680
So you might have to be a little bit creative on how you're sharing information, what you're sharing with them, um, and finding those people that do care and you know, doing the other approach for them of and uh encouraging them more, like finding those folks that do report to you a lot and finding a way to kind of loop them in more and use that to your advantage, as opposed to pushing people away that um are you know willing to kind of give come forward with that type of thing.
00:18:17.680 --> 00:18:20.319
So it is a it's it's always going to be a push-pull.
00:18:20.319 --> 00:18:24.319
I think it's always gonna be a reason uh why these things are so complicated.
00:18:24.319 --> 00:18:28.960
And I think it also ties back to understanding your environment more, right?
00:18:28.960 --> 00:18:35.440
If you can just understand the typical user behaviors, then you can kind of see those discrepancies a little bit faster.
00:18:35.440 --> 00:18:42.480
You can alert on those types of things rather than seeing it appear for the first time, it's clearly a bad thing, and just blaming the user.
00:18:42.480 --> 00:18:47.039
Uh, there's always other things that you can do, even though they're not the most fun or easy.
00:18:47.359 --> 00:18:47.759
Yes.
00:18:47.759 --> 00:18:48.400
Yeah.
00:18:48.400 --> 00:18:56.720
And and as you said, like these kinds of incidents can happen to anyone, any organization.
00:18:56.720 --> 00:19:23.119
And so, like for the practitioners who are listening to this, looking at their own environments and wondering if that could happen to them, um, as a closer, what are the top two or three things that they should be doing or auditing or implementing today to kind of prevent this cloud native attack or at least kind of minimize the blast radius for them?
00:19:23.599 --> 00:19:23.920
Yeah.
00:19:23.920 --> 00:19:33.440
Um, I think a lot of it is gonna come down to um getting a good feel for what you can actually see in your environment today.
00:19:33.440 --> 00:19:40.960
So, you know, as soon as you're done with this, go look into your Microsoft um tenant and try to see what kind of logs you can even see.
00:19:40.960 --> 00:19:48.000
Can you actually view uh someone getting a phishing email, whether it's quarantined, what actions are taken?
00:19:48.000 --> 00:19:52.640
Can you see whether they clicked on a link, like what kind of detail you actually have?
00:19:52.640 --> 00:20:00.160
Uh, because at the end of the day, even if something happens, you still want to make sure you can understand what occurred as much as possible.
00:20:00.160 --> 00:20:08.640
Um, and then in addition to that, uh QR codes are obviously going to be a little bit tricky, but uh it is something you can still account for.
00:20:08.640 --> 00:20:11.680
Um, it's the same as any other PDF, right?
00:20:11.680 --> 00:20:19.839
The PDF still had to reach them if it's coming from an external uh entity, if you know, matching on the things like it's calling out payroll.
00:20:19.839 --> 00:20:27.039
It has a PDF assigned to it, kind of attaching all those behaviors together in a way that can make things a little bit more robust.
00:20:27.039 --> 00:20:29.519
Um, but I think a lot of it comes down to response.
00:20:29.519 --> 00:20:34.640
Uh, one thing, you know, I do want to make sure you call out with us is the organization responded quickly.
00:20:34.640 --> 00:20:39.279
Um, and it didn't really explode into anything horrific, right?
00:20:39.279 --> 00:20:44.319
It's still an incident, it's still something, of course, they have to learn from and they'll want to make sure things don't get worse.
00:20:44.319 --> 00:20:48.319
But the reason it didn't get worse was because they were able to respond.
00:20:48.319 --> 00:20:50.720
They were able to disable that account very quickly.
00:20:50.720 --> 00:20:57.359
They were able to identify, you know, what this user was actually accessing and what they did to those SharePoint pages.
00:20:57.359 --> 00:21:08.319
That type of detail will go a long ways because then you feel much more comfortable about the fact that, yeah, I'm gonna disable this account or we're going to turn off access for this user for a little bit.
00:21:08.319 --> 00:21:10.640
Um, but we have reasons of why we're doing it.
00:21:10.640 --> 00:21:16.640
We're not just gonna say we're gonna do it, make them angry, and then cause more strife until we get an actual answer.
00:21:16.640 --> 00:21:21.200
So to me, it all comes down to visibility, what you can actually see.
00:21:21.200 --> 00:21:29.599
Um, so you know if something like this were to occur, you know you can find it very quickly and hopefully create detections around it before something like that even happens.
00:21:29.920 --> 00:21:31.119
Well, I guess that's it.
00:21:31.119 --> 00:21:32.400
Thanks so much for joining.
00:21:32.640 --> 00:21:33.680
Yeah, thank you so much.
00:21:33.759 --> 00:21:34.720
It was great talking.
00:21:34.960 --> 00:21:44.319
Well, everyone, if you do want to hear more stories directly from Talos Incident Responders, um, watch for our next quarterly trends report.
00:21:44.319 --> 00:21:48.799
Um, every quarter we hold a webinar called Tales from the Frontlines.
00:21:48.799 --> 00:22:02.960
It is an unrecorded 30-minute session where our incident responders talk about the most high impact cases that they saw in the last quarter and give out useful insights on how you can strengthen your defenses.
00:22:02.960 --> 00:22:06.880
I will put the link to our latest quarterly trends report below.
00:22:06.880 --> 00:22:12.640
But if you are more of a podcast learner, the previous Tallowstakes episode covered it as well.
00:22:12.640 --> 00:22:15.920
Thanks so much for listening and stay safe out there.
00:00:00.160 --> 00:00:06.320
Welcome to the Talos Takes Podcast, where we discuss Talos' latest research and security news.
00:00:06.320 --> 00:00:10.800
This podcast is for everyone, from the C suite to the front lines.
00:00:10.800 --> 00:00:15.919
Hello, everyone, and welcome to Talos Takes.
00:00:15.919 --> 00:00:18.079
I'm your host, Amy Ciminnisi.
00:00:18.079 --> 00:00:28.559
Today is a very exciting episode for me because we are examining a real incident that Talos Incident Response faced last quarter.
00:00:28.559 --> 00:00:39.200
It impacted an Australian medical center, and it really shows how attackers are bypassing defenses by operating entirely within the cloud.
00:00:39.200 --> 00:00:41.679
We are going to discuss a few things.
00:00:41.679 --> 00:00:45.200
First, the rise of QR-based phish.
00:00:45.200 --> 00:00:49.200
Second, the challenges of securing non-corporate devices.
00:00:49.200 --> 00:00:55.280
And three, the human impact of defending these high-stakes environments.
00:00:55.280 --> 00:01:01.280
So joining me to walk through the investigation is senior incident response consultant Terryn Valikodath.
00:01:02.320 --> 00:01:03.759
How are you doing?
00:01:04.159 --> 00:01:04.959
I'm doing well.
00:01:04.959 --> 00:01:06.000
How about yourself?
00:01:06.000 --> 00:01:09.680
It's been a little bit since I've been on here, but I'm glad to be back.
00:01:10.000 --> 00:01:10.560
I know.
00:01:10.560 --> 00:01:12.480
I'm very glad to have you back.
00:01:12.480 --> 00:01:19.439
Uh, listeners, you may know Terryn from an episode of Humans of Talos that we released several months back.
00:01:19.439 --> 00:01:29.519
Um, if you want to learn more about his background, uh his love for dinosaur bones and forensic anthropology, uh, go right ahead.
00:01:29.519 --> 00:01:30.959
Go check that out.
00:01:30.959 --> 00:01:31.519
Okay.
00:01:31.519 --> 00:01:33.760
So, Terryn, let's get into this.
00:01:33.760 --> 00:01:36.400
You worked on this incident yourself, right?
00:01:36.799 --> 00:01:37.599
Yes, that's correct.
00:01:37.599 --> 00:01:37.920
Yep.
00:01:37.920 --> 00:01:40.560
I was a part of it, the entire length of it.
00:01:40.959 --> 00:01:41.359
Wow.
00:01:41.359 --> 00:01:57.120
I I feel like one of the most interesting things to me about this incident is that it is involving, you know, a medical center where the stakes are higher than, you know, a typical corporate environment, right?
00:01:57.120 --> 00:01:59.519
Because people's lives can be on the line.
00:01:59.519 --> 00:02:09.840
Um, when you join that initial call, how do you like manage the tension and pressure of knowing that an incident here could impact patient care?
00:02:10.400 --> 00:02:24.560
Yeah, no, it's a it's a huge kind of undertaking to realize sometimes that what's going to happen could actually impact things to that degree, um, especially having someone, uh, my wife that actually works in healthcare as well.
00:02:24.560 --> 00:02:28.639
They know it too far too well of how much that can be a disruption.
00:02:28.639 --> 00:02:32.319
Um, but realistically, I I don't think it changes too much.
00:02:32.319 --> 00:02:43.520
Um, I think it really is about just making sure that you kind of remain even more calm and collected because oftentimes the people that we're working with, they don't have that luxury.
00:02:43.520 --> 00:02:49.280
So we need to make sure that we can for them and kind of explain exactly what we're going to do.
00:02:49.280 --> 00:03:07.039
And when we're talking about medical, I think it really comes down to understanding um impact, like what is truly going to be impacted, and knowing that there might be things that they just cannot risk, that they might need to make decisions that maybe a different enterprise would say, no, let's hold off on that.
00:03:07.039 --> 00:03:09.919
But for them, it's critical and they need to take that risk.
00:03:09.919 --> 00:03:19.120
So being very thorough about what exactly you're finding and giving clear recommendations and alternatives, um, I think is is really what comes up in those types of cases.
00:03:19.439 --> 00:03:28.879
Um, and so in this case specifically, there was a very specific, highly personalized lure uh that kind of opened the door to compromise.
00:03:28.879 --> 00:03:35.039
Can you walk us through, you know, what did that initial email to the employee look like?
00:03:35.039 --> 00:03:40.479
Uh, how how was it able to bypass those typical red flags that we are trained to look for?
00:03:40.879 --> 00:03:41.199
Yeah.
00:03:41.199 --> 00:03:47.599
Um, so the email was a little bit different because it came in as a phishing email that I'm sure everyone is familiar with.
00:03:47.599 --> 00:03:53.840
Um, it pretended to be um a payroll adjustment, so to capture kind of the employee's attention right away.
00:03:53.840 --> 00:03:59.199
Um, but the unique thing was that it had a PDF attachment, which is also not unusual.
00:03:59.199 --> 00:04:03.280
But within the PDF was actually where we see the QR code.
00:04:03.280 --> 00:04:10.159
And that's where it kind of changes things up a little bit because when you see a QR code, people naturally want to scan it.
00:04:10.159 --> 00:04:14.719
And you're not scanning it with the device you're using, you're scanning it with a mobile device.
00:04:14.879 --> 00:04:15.039
Yeah.
00:04:15.199 --> 00:04:23.839
Um, so what happens in that case is the user scans it with their mobile device, they get the fake login page like we see over and over again.
00:04:23.839 --> 00:04:31.360
But the problem being it's on a device that doesn't have the same protections, uh, that's not as visible to the organization.
00:04:31.360 --> 00:04:38.639
So when they put in those credentials into that page, uh, everything is kind of happening almost offline.
00:04:38.639 --> 00:04:45.920
Uh so it presents a much bigger challenge uh because the adversary on the other side, they're kind of using that information live.
00:04:45.920 --> 00:04:48.879
They're taking those logins, trying to log in directly.
00:04:48.879 --> 00:04:52.879
That's going to maybe prompt MFA for the user, which they would expect.
00:04:52.879 --> 00:04:54.160
They just put credentials in.
00:04:54.160 --> 00:04:57.120
So it looks very normal from their standpoint.
00:04:57.120 --> 00:05:04.240
So when you lack the visibility from an organization security standpoint, you would have no idea.
00:05:04.240 --> 00:05:11.360
Um, it's just something that kind of happens completely offline, but from the attacker perspective, you know, it's everything they would need to get in.
00:05:11.360 --> 00:05:16.160
Um, and the victim just is completely unaware, uh, all because it's on a separate device.
00:05:16.480 --> 00:05:25.519
I'm curious how we need to change how we're thinking about like corporate owned versus personal device security.
00:05:25.519 --> 00:05:34.000
Like, obviously, uh, you know, you can't put all of these security controls on people's personal devices who are your employees.
00:05:34.000 --> 00:05:37.279
Um wow, big issue.
00:05:37.279 --> 00:05:46.160
Um, but like what can we do to try and like mitigate that risk that the situation present presents?
00:05:46.560 --> 00:05:58.160
Yeah, I think it's it really comes down to like, like you said, it's it's not a feasible task, in my opinion, to be able to get only provide phones that belongs to organizations that have these protections.
00:05:58.160 --> 00:06:04.720
And even when we're talking about phones in general, uh, we just can't see it the same way we would see a Windows laptop.
00:06:04.720 --> 00:06:10.480
So even if we did have that, I don't know if it would really change too much in terms of what you can change and do.
00:06:10.480 --> 00:06:15.759
Um, but I think a lot of it really just come down to the simple answer of just educating people.
00:06:15.759 --> 00:06:20.079
Like when you see a QR code via PDF, like that's probably something you shouldn't scan.
00:06:20.079 --> 00:06:29.120
Or like if you're going to interact with anything that's asking for you to log in, make sure it's on those kind of approved devices or going through a certain method.
00:06:29.120 --> 00:06:32.319
Um, it's a really tough situation to kind of get around.
00:06:32.319 --> 00:06:41.759
I think it's one of those avenues that clearly shows threat actors are just getting more and more savvy by just kind of taking advantage of how we do our everyday life.
00:06:41.759 --> 00:06:47.279
It's not like they're doing some crazy exploit or doing some ultra-technical task.
00:06:47.279 --> 00:06:53.920
Uh, it's really just watching, observing how people do their day-to-day and then seeing where they can kind of insert themselves.
00:06:53.920 --> 00:06:56.000
Uh, so there's unfortunately not an easy answer.
00:06:56.000 --> 00:07:04.160
I think it's really just uh a matter of educating, hopefully, like we are now, so you know that these types of things can occur and what they could potentially lead to.
00:07:04.480 --> 00:07:14.720
As an incident responder, this QR code phishing, we have put out like a few different articles and such about it over the years.
00:07:14.720 --> 00:07:19.279
Um, but like how how often do you see that pop up in your incidents?
00:07:19.279 --> 00:07:23.600
Is it often, is this kind of the first case in a while that you've seen?
00:07:23.600 --> 00:07:27.519
Um, and how how prevalent is it really that we know of?
00:07:27.839 --> 00:07:32.319
Yeah, I would say it's pretty recent that it's becoming more notable.
00:07:32.319 --> 00:07:44.959
Um, I'll admit, like maybe five years ago, the the idea of QR code phishing was kind of like this anomaly, even for myself, of like, yeah, sure, it's technically possible, but how would that actually be done?
00:07:44.959 --> 00:07:45.279
Yeah.
00:07:45.279 --> 00:07:49.519
Uh, but now we're kind of seeing, like, yes, it can clearly still be done.
00:07:49.519 --> 00:07:52.480
Um, and that inherent trust is still there.
00:07:52.480 --> 00:08:01.120
And I think the the difficulty and the scary part is if it happens, you won't necessarily know what's happening unless you're talking with the user.
00:08:01.120 --> 00:08:05.199
You can kind of do that comparison, you can look at those emails yourself.
00:08:05.199 --> 00:08:08.560
So, yeah, it's definitely something more recent, I would say.
00:08:08.560 --> 00:08:24.319
Um, it definitely was not top of the radar before like it is now, but now I think it's clearly shown that um it can still work um and it can lead to some pretty crazy stuff, even though uh it's relatively simple and it might be one of those things that people scoff at when they first hear about it.
00:08:24.639 --> 00:08:29.759
Yeah, adding that into your employee training is just so necessary now.
00:08:30.079 --> 00:08:30.399
Yeah.
00:08:30.399 --> 00:08:39.759
Yeah, and I think also a point to anyone that's doing those education trainings, being able to show what it can lead to, I think is a really good way to emphasize it.
00:08:39.759 --> 00:08:56.399
Because everybody knows phishing exists, but I think until you kind of put into the frame of what can happen as a result of your account being compromised, um, is a is a good way to put it forward rather than folks just kind of assuming that, oh, they don't need my data, so they're not gonna go after me.
00:08:56.399 --> 00:08:59.200
That's not really what it's about in a lot of these cases.
00:08:59.679 --> 00:09:00.480
100%.
00:09:00.480 --> 00:09:01.440
Yeah.
00:09:01.440 --> 00:09:02.080
Okay.
00:09:02.080 --> 00:09:09.600
So let's talk about um how this kind of took place within Microsoft uh cloud products, right?
00:09:09.600 --> 00:09:14.159
Nothing ever touched, you know, an internal workstation or a server.
00:09:14.159 --> 00:09:20.320
Um can you kind of talk about that and what that means for like hunting for evidence?
00:09:21.039 --> 00:09:21.919
Yeah, absolutely.
00:09:21.919 --> 00:09:29.840
So in this case, what we saw is as soon as they got those credentials, they they logged in using that user's information.
00:09:29.840 --> 00:09:36.639
Um, and from that point, um, all they really did was go into things like SharePoint.
00:09:36.639 --> 00:09:46.559
Uh we didn't see it, but they could access things like OneDrive or anything else that uh you would kind of work with your day-to-day type of work for documents and things like that.
00:09:46.559 --> 00:10:01.840
Um, but the interesting thing we saw with this is they actually accessed uh SharePoint and they tried to stage one of the SharePoint sites as another phishing link and then invite as many users as they can, from what we can tell.
00:10:01.840 --> 00:10:03.759
I think just their entire contact list.
00:10:03.759 --> 00:10:07.120
So this is internal users and even other companies.
00:10:07.120 --> 00:10:10.399
Um, so they're just blasting this out to as many people as possible.
00:10:10.399 --> 00:10:14.080
Luckily, I think that was blocked, so it didn't get to that point.
00:10:14.080 --> 00:10:25.200
Um, but you can see them kind of trying to do this worming of get into one location, expand out, and just keep going and going and going until they can hit as many as they possibly can.
00:10:25.200 --> 00:10:38.960
Um, but like you said, the the interesting thing is they never touched, you know, a user's desktop, they never accessed someone's server, they never really got into what we would traditionally think of uh of a hack.
00:10:38.960 --> 00:10:46.399
Um they're really just staying within the account, uh within SharePoint, within these Microsoft products that are just all online available.
00:10:46.399 --> 00:10:57.440
Uh so it does introduce some complexities in investigating too, because uh some of these things are not by default set up to show you every little thing that happens.
00:10:57.440 --> 00:11:10.480
Um, so there is a lot more inference you have to make, there's a lot more details you have to kind of extract from different locations rather than something as clear as like a Windows event log that's gonna clearly tell you here's what this user account did from A to B.
00:11:10.480 --> 00:11:18.399
Uh so doing that kind of comparison is becoming more of a skill that we're realizing you need to keep up uh because those things change so often.
00:11:18.399 --> 00:11:22.480
And Microsoft also likes to change, you know, how they log certain things or what they're doing.
00:11:22.480 --> 00:11:27.679
So being on top of what you can actually see uh is half the battle, in my opinion.
00:11:28.320 --> 00:11:39.679
Kind of a recurring theme over the past several Talestakes episodes that I've noted is the idea of bypassing MFA and traditional MFA not always being enough.
00:11:39.679 --> 00:11:52.639
Um you mentioned that we don't have the exact play-by-play of you know the user's screen and you know what they saw, but we do know the outcome that the adversary got in.
00:11:52.639 --> 00:12:00.080
Um what are some of the signs that an adversary is abusing a session in the cloud?
00:12:00.080 --> 00:12:05.519
And you know, what what should teams be looking for in their logs to try and catch this a little bit earlier?
00:12:05.840 --> 00:12:07.279
Yeah, no, great question.
00:12:07.279 --> 00:12:20.399
Um, I think one of the first things we often look for is the sign-ins to see are they suddenly signing in from uh a new country or kind of a new uh range IP range that you wouldn't expect.
00:12:20.399 --> 00:12:24.240
Other things we commonly look for is new devices being registered.
00:12:24.240 --> 00:12:37.200
Uh, one common thing we like we see adversaries like to do is once they get into someone's account to kind of retain that access, they'll register their own phone or a different device that can take the MFA request from that point on.
00:12:37.200 --> 00:12:57.840
And then um uh if you really want to get down to technical details, if you look into uh token usage, um, you can see very clearly in some of the logs that uh when a token is being reissued or it's being reset, or maybe they're using the same one over and over again in different sessions where that isn't typically the case.
00:12:57.840 --> 00:13:02.559
Uh so yeah, a lot of it is coming down to just those anomalies and discrepancies.
00:13:02.559 --> 00:13:08.240
Uh, but I think the biggest challenge you'll have is making sure you have some kind of understanding of what the normal is.
00:13:08.240 --> 00:13:10.480
Where are they typically logging in from?
00:13:10.480 --> 00:13:12.960
You know, do they live in multiple locations?
00:13:12.960 --> 00:13:16.159
Is there a reason a different IP address may pop up?
00:13:16.159 --> 00:13:23.759
Uh so it does take a lot of coordination either with the user themselves or just kind of an understanding of what's going on in the environment.
00:13:23.759 --> 00:13:36.720
So you can clearly show that this is an anomaly because you'll be surprised how many uh uh false positives you'll see just because people use VPNs, people might be untraveling and accessing things on their phone.
00:13:36.720 --> 00:13:44.799
So uh it is definitely a little bit of a game of understanding the common behaviors, and then you can do a better job of looking for those anomalies.
00:13:45.120 --> 00:13:58.320
So once organizations catch that first indicator, um, you know, they look into it, they triage it, um, and determine that it's something that they need to look into and open an incident.
00:13:58.320 --> 00:14:04.159
What are the steps that you take to remediate something like this?
00:14:04.159 --> 00:14:12.240
Um, and how do you know when the environment is sufficiently normal enough to close out the incident?
00:14:12.799 --> 00:14:13.200
Yeah.
00:14:13.200 --> 00:14:31.600
Um, so the first thing I think anytime you see activity like this where someone's account's being compromised is having a very quick way to either disable the account, reset the password, revoke the sessions, which all of that is built into Microsoft tools, so it's not too difficult, but making sure you can do it as fast as possible.
00:14:31.600 --> 00:14:40.960
Um, and I think the next thing that we often run into is being able to provide access to say us or anyone else that's going to help investigate.
00:14:40.960 --> 00:14:46.960
Um, sometimes it's the first time organizations will do this, so they don't have a clear idea of how to provide external access.
00:14:46.960 --> 00:14:51.679
Uh, we of course help out with that, but knowing that ahead of time can certainly speed things up.
00:14:51.679 --> 00:14:56.480
Or if you know, you know, which logs we need to grab, it can extract those ahead of time.
00:14:56.480 --> 00:14:59.200
Those types of steps um go a long way.
00:14:59.200 --> 00:15:09.440
Um, but yeah, really a lot of it is just looking at those discrepancies, um, not being afraid to kind of do a little bit more if you have to, right?
00:15:09.440 --> 00:15:15.919
Um, in some cases we see like this, uh maybe there was multiple users that were involved in that invitation.
00:15:15.919 --> 00:15:17.679
Uh, you might just take that precaution.
00:15:17.679 --> 00:15:19.679
Let's just reset the password for all of them.
00:15:19.679 --> 00:15:27.279
You know, even if we don't see a clear that sign in or some other type of evidence, uh, being able to take those actions is always best.
00:15:27.279 --> 00:15:33.440
I mean, as much as we love to preserve evidence as much as possible, at the end of the day, we want to make sure things don't get worse.
00:15:33.440 --> 00:15:41.919
So we would much rather you take action and we lose a little bit of evidence than waiting too long and things get worse before any action is taken at all.
00:15:42.240 --> 00:15:43.919
Yeah, 100%.
00:15:43.919 --> 00:15:55.039
Um, and I can't help but think about both the IT teams of the organization and also like the person who fell victim to the phishing link.
00:15:55.039 --> 00:16:03.039
I feel like there might be kind of a knee-jerk reaction to blame that person and to assign that blame.
00:16:03.039 --> 00:16:27.840
Um, from your perspective, how do you kind of steer leadership or steer whoever you're communicating with toward kind of more of a blameless and educational culture that focuses on those educational improvements rather than you know pointing fingers at people who didn't know or maybe were a little bit careless in a situation like this.
00:16:28.240 --> 00:16:28.879
Yeah, absolutely.
00:16:28.879 --> 00:16:33.360
Uh yeah, we I don't think you can ever really blame a user in those situations.
00:16:33.360 --> 00:16:41.039
When we're talking about the situation like right here with the QR code, yeah, it's so hard to imagine something like that would even happen.
00:16:41.039 --> 00:16:51.200
Um if you're thinking about your work every day and then something like this occurring, that's not even close to the top of your mind if you're working in accounts payable, HR, wherever else.
00:16:51.200 --> 00:16:55.360
Um, so of course, it's not really their main concern.
00:16:55.360 --> 00:16:58.879
But um, yeah, I think a lot of it is just sharing more.
00:16:58.879 --> 00:17:06.240
I think it really does just come down to just being more upfront about when you see these things even happening in the organization.
00:17:06.240 --> 00:17:18.640
So, example with this one, uh, as soon as we saw this, we asked them, like, hey, is it worth just issuing a communication to the rest of your um organization about, hey, this has happened, watch out for it.
00:17:18.640 --> 00:17:23.279
Just so when you see that, people feel more willing to kind of come up to you and tell you those things.
00:17:23.279 --> 00:17:35.839
Because I'm sure there's situations that happen that just nobody reports, nobody mentions that it's actually occurred until it gets to a point that it feels very uh it feels the need to blame someone.
00:17:36.000 --> 00:17:36.240
Yeah.
00:17:36.799 --> 00:17:43.359
But usually that means there could have been a proactive measure, whether that's just educating people more about what's going on.
00:17:43.359 --> 00:17:50.960
And sometimes it's more about making it more interesting on how you're educating people, because nobody likes doing the annual training sometimes.
00:17:50.960 --> 00:18:17.680
So you might have to be a little bit creative on how you're sharing information, what you're sharing with them, um, and finding those people that do care and you know, doing the other approach for them of and uh encouraging them more, like finding those folks that do report to you a lot and finding a way to kind of loop them in more and use that to your advantage, as opposed to pushing people away that um are you know willing to kind of give come forward with that type of thing.
00:18:17.680 --> 00:18:20.319
So it is a it's it's always going to be a push-pull.
00:18:20.319 --> 00:18:24.319
I think it's always gonna be a reason uh why these things are so complicated.
00:18:24.319 --> 00:18:28.960
And I think it also ties back to understanding your environment more, right?
00:18:28.960 --> 00:18:35.440
If you can just understand the typical user behaviors, then you can kind of see those discrepancies a little bit faster.
00:18:35.440 --> 00:18:42.480
You can alert on those types of things rather than seeing it appear for the first time, it's clearly a bad thing, and just blaming the user.
00:18:42.480 --> 00:18:47.039
Uh, there's always other things that you can do, even though they're not the most fun or easy.
00:18:47.359 --> 00:18:47.759
Yes.
00:18:47.759 --> 00:18:48.400
Yeah.
00:18:48.400 --> 00:18:56.720
And and as you said, like these kinds of incidents can happen to anyone, any organization.
00:18:56.720 --> 00:19:23.119
And so, like for the practitioners who are listening to this, looking at their own environments and wondering if that could happen to them, um, as a closer, what are the top two or three things that they should be doing or auditing or implementing today to kind of prevent this cloud native attack or at least kind of minimize the blast radius for them?
00:19:23.599 --> 00:19:23.920
Yeah.
00:19:23.920 --> 00:19:33.440
Um, I think a lot of it is gonna come down to um getting a good feel for what you can actually see in your environment today.
00:19:33.440 --> 00:19:40.960
So, you know, as soon as you're done with this, go look into your Microsoft um tenant and try to see what kind of logs you can even see.
00:19:40.960 --> 00:19:48.000
Can you actually view uh someone getting a phishing email, whether it's quarantined, what actions are taken?
00:19:48.000 --> 00:19:52.640
Can you see whether they clicked on a link, like what kind of detail you actually have?
00:19:52.640 --> 00:20:00.160
Uh, because at the end of the day, even if something happens, you still want to make sure you can understand what occurred as much as possible.
00:20:00.160 --> 00:20:08.640
Um, and then in addition to that, uh QR codes are obviously going to be a little bit tricky, but uh it is something you can still account for.
00:20:08.640 --> 00:20:11.680
Um, it's the same as any other PDF, right?
00:20:11.680 --> 00:20:19.839
The PDF still had to reach them if it's coming from an external uh entity, if you know, matching on the things like it's calling out payroll.
00:20:19.839 --> 00:20:27.039
It has a PDF assigned to it, kind of attaching all those behaviors together in a way that can make things a little bit more robust.
00:20:27.039 --> 00:20:29.519
Um, but I think a lot of it comes down to response.
00:20:29.519 --> 00:20:34.640
Uh, one thing, you know, I do want to make sure you call out with us is the organization responded quickly.
00:20:34.640 --> 00:20:39.279
Um, and it didn't really explode into anything horrific, right?
00:20:39.279 --> 00:20:44.319
It's still an incident, it's still something, of course, they have to learn from and they'll want to make sure things don't get worse.
00:20:44.319 --> 00:20:48.319
But the reason it didn't get worse was because they were able to respond.
00:20:48.319 --> 00:20:50.720
They were able to disable that account very quickly.
00:20:50.720 --> 00:20:57.359
They were able to identify, you know, what this user was actually accessing and what they did to those SharePoint pages.
00:20:57.359 --> 00:21:08.319
That type of detail will go a long ways because then you feel much more comfortable about the fact that, yeah, I'm gonna disable this account or we're going to turn off access for this user for a little bit.
00:21:08.319 --> 00:21:10.640
Um, but we have reasons of why we're doing it.
00:21:10.640 --> 00:21:16.640
We're not just gonna say we're gonna do it, make them angry, and then cause more strife until we get an actual answer.
00:21:16.640 --> 00:21:21.200
So to me, it all comes down to visibility, what you can actually see.
00:21:21.200 --> 00:21:29.599
Um, so you know if something like this were to occur, you know you can find it very quickly and hopefully create detections around it before something like that even happens.
00:21:29.920 --> 00:21:31.119
Well, I guess that's it.
00:21:31.119 --> 00:21:32.400
Thanks so much for joining.
00:21:32.640 --> 00:21:33.680
Yeah, thank you so much.
00:21:33.759 --> 00:21:34.720
It was great talking.
00:21:34.960 --> 00:21:44.319
Well, everyone, if you do want to hear more stories directly from Talos Incident Responders, um, watch for our next quarterly trends report.
00:21:44.319 --> 00:21:48.799
Um, every quarter we hold a webinar called Tales from the Frontlines.
00:21:48.799 --> 00:22:02.960
It is an unrecorded 30-minute session where our incident responders talk about the most high impact cases that they saw in the last quarter and give out useful insights on how you can strengthen your defenses.
00:22:02.960 --> 00:22:06.880
I will put the link to our latest quarterly trends report below.
00:22:06.880 --> 00:22:12.640
But if you are more of a podcast learner, the previous Tallowstakes episode covered it as well.
00:22:12.640 --> 00:22:15.920
Thanks so much for listening and stay safe out there.
