di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

AMSI-blog.png

The Deep Instinct Research team has found two new AMSI bypass techniques; <a href="/pdf/antimalware-scan-interface-amsi-unchained" target="_self">read the white paper</a>.&nbsp;AMSI (Anti-Malware Scan Interface) is Microsoft’s framework that allows third-party antimalware solutions to gain visibility into Microsoft components and applications, such as PowerShell, script engines, .NET framework, and WMI. <a href="/endpoint-detection-response" target="_self">Endpoint Detection and Response (EDR) solutions</a> use this framework to scan files, memory, and/or streams for malicious payloads.&nbsp;Bad actors responded to these defensive approaches by developing multiple AMSI bypass techniques. This started an innovation battle between the attackers and EDR solutions, who have tried to play keep-up and protect their customers against these threats. There was initially an explosion in new bypass techniques but efforts on both sides have reached stagnation, with the last AMSI bypass technique being introduced back in 2019.&nbsp;To address these threats, Deep Instinct mapped all known AMSI bypass techniques and developed complete protection against them. During these efforts our researchers found two new portable, undocumented, and undetected AMSI bypass techniques that target an unmonitored area of the AMSI architecture.&nbsp;After full disclosure to Microsoft and a subsequent presentation at Black Hat ASIA 2022, we wrote a white paper that details these findings in-depth – we'd welcome you to <a href="/pdf/antimalware-scan-interface-amsi-unchained" target="_self">read the full research white paper</a> and discover how AMSI bypass attacks have become stealthier than ever. Or, if you’d prefer, <a href="https://info.deepinstinct.com/request-a-demo" target="_self">request a demo</a>.&nbsp;

AMSI Unchained: How to Unchain the Antimalware Providers and Bypass AMSI

Almost 40% of organizations surveyed in a recent Verizon report said they had experienced a mobile-related security compromise. Of those, 66% said the

android-security.jpg

Almost 40% of organizations surveyed in a recent Verizon report said they had experienced a mobile-related security compromise. Of those, 66% said the impact was major. Major security breaches cost organizations time, money, and public trust. Android security is critical, particularly in Bring-Your-Own-Device (BYOD) environments. You have more control over corporate devices, but all devices used for business purposes need to be secured from hackers. Learn more about Android threats and how to improve <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile security</a>.
<h3>Android Threat Landscape</h3>
Hackers take advantage of multiple points of vulnerability, including:
<ul>
<li>Apps — Apps offer hackers a wealth of opportunities. These include threats, where malware is embedded in a malicious app, and vulnerabilities, which are flaws in otherwise benign apps that hackers manipulate. Both threats and vulnerabilities could be used to access company data. Ransomware is another possibility, where the phone is locked until a ransom is paid. Phones are also being used for crypto-jacking, where a device is used to mine cryptocurrency, which drains the device and causes other performance issues.</li>
</ul>
&nbsp;
<ul>
<li>Data leakage — Users may inadvertently download either malicious apps or benign apps with security vulnerabilities. Either of these could leak confidential company information. They may also unintentionally make mistakes, like transferring company files to the wrong place or copying and pasting proprietary information into the wrong field, which hackers could take advantage of.</li>
</ul>
&nbsp;
<ul>
<li>Unsecured Wi-Fi - People tend to save on cellular data usage when wireless hot spots are available. The same features that make Wi-Fi hotspots easy to use for consumers make them a fertile breeding ground for hackers. The fact that authentication is not required to establish a network connection creates an amazing opportunity for the hacker to gain access to the network and consequently also to insecure devices on the same network.</li>
</ul>
&nbsp;
<ul>
<li>Phishing - According to the CSO, mobile users are more vulnerable to phishing attacks because they follow email frequently and open and read emails as soon as they are received. In addition, the messages received in mobile email applications hide some of the information about the source of the message more than on a PC, which can lead to confusion and opening of messages from unverified sources.</li>
</ul>
&nbsp;
<ul>
<li>Social engineering — Even if you’ve educated your end-users on cybersecurity, they may still be vulnerable when checking email on their phone. It’s harder to see the “to” and “from” email addresses and other details when checking email on a phone, meaning end-users may respond or click links without scrutinizing them.</li>
</ul>
&nbsp;
<ul>
<li>Physical device breaches — Phones are easy to lose or leave unattended. If that’s combined with the surprising number of users who don’t practice good password hygiene, you have a recipe for easy access to your organization’s data.</li>
</ul>
<h3>Android Security: Essential Steps to Take</h3>
Combat these threats, and more, by developing clear policies. Train your end-users on these policies and how to implement them. Follow up with your end-users regularly to ensure your organization’s policies are being followed. Policies to consider include:
<ul>
<li>Phone locking — While it might seem simple, many find taking the extra step of unlocking their phone annoying, so they don’t do it. A PIN of more than four digits is the best way to secure a phone. It protects both company information and personal information of the employee.</li>
<li>Install security updates — Remind end-users not to put off an Android security update. These are critical, but they’re released by phone manufacturers, so not all employees will have Android security updates at the same time.</li>
<li>Only using reliable apps from the Google Play Store — The Google Play Store takes measures to verify apps and scan apps for security. End-users should stick with these verified apps.</li>
<li>Confirming Google Play Protect is working — Google Play Protect is Android’s security system. End-users can confirm it’s working by visiting Security in their phone settings and tapping “Google Play Protect,” than ensuring all the toggles are activated.</li>
<li>Enabling Find My Device — For end-users to know whether their phone is misplaced or lost, have them enable Find My Device. It can be turned on in the security settings, and there’s also an official Find My Device app.</li>
<li>Add emergency contact info — End-users can add an emergency contact to their phone in case it’s lost. They can find it in system settings, and can also add a lock screen message directing people on how to access your emergency information.</li>
<li>Use Chrome’s safe browsing mode — The Chrome browser on an Android is the most secure option for web browsing. It has a safe browsing mode, and users can confirm it’s on by looking in their Chrome settings.</li>
<li>Using VPNs — You may want to recommend a specific VPN for your end-users to use, as there are many options. You should also address when and how to use it, like when they’re using free Wi-Fi at a coffee shop.</li>
</ul>
Another way to secure <a href="https://www.deepinstinct.com/2020/08/02/mobile-security-and-why-i-hate-byod-policies/" target="_blank" rel="noopener noreferrer">BYOD devices</a> is by using an Android work profile. This sets up a second profile that runs alongside a user’s personal profile. Their personal information stays private, while your corporate information stays secure. You can also implement policies like screen locks, encryption, and not allowing employees to copy and paste from work to personal apps and VPNs. All employees need to do is download this type of Android security app and sign in with their corporate credentials.
All of these steps can be enhanced by deploying Deep Instinct’s advanced <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile security solution</a>. It’s the best security app for Android, offering multiple layers of protection driven by deep learning, the most advanced AI technology.
&nbsp;

How to Secure an Android Phone from Hackers

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.