We use cookies to personalize content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services.
Some of the data collected by this provider is for the purposes of personalization and measuring advertising effectiveness.
Some of the data collected by this provider is for the purposes of personalization and measuring advertising effectiveness.
We do not use cookies of this type.
October 4, 2023
Hello everybody. Thanks for joining to our webinar. We're gonna be beginning in, a couple of minutes.
To everybody is, checked.
So we're gonna begin.
Thank you everybody for joining for this session, for the webinar of my trade evaluation.
Today, we gotta be showing, first of all, our product, the uniqueness of our product, we're gonna be talking about mitral evaluation that we participated earlier this year. And then we're gonna be, saying a few words about our product, I would perform in the evaluation, and a key takes from, the evaluation itself. And a bit technical information about what was tested during the evaluation of my trip. So I'm gonna begin and Our speaker is still gonna be Simone, who is the chief development officer of the Pain Stink, myself, Alex, director of cyber research and Daniel, which is, threat research team lead, in our company. So that agenda for today. First of all, we're gonna be, saying a few words about our product, why it's so unique and, the keys and the special, things that we know to do in the creation of other vendors, then we gotta be speaking about, basically, what is my train of technical evaluation and how the result results are calculated.
Then we're gonna be talking a bit technical about true APT that was executed during the affiliation.
We gotta be done explaining the results both for a detection and prevention days.
That we're gonna be summing up all the conclusions, all the takes that we have from the evaluation.
And again, we're gonna be, having a few minutes for questions. And it's important to mention this before I begin the presentation.
That this session is being recorded.
And if you, have any need to see that again, you have a opportunity to do that on bright duck website. And if you have any questions, you can write it down on the right or left side. It depends on your computer. And we will address those, in the quarter of time that we have in the end of the webinar.
So let's get deep down into what is deep instinct?
So, first of all, we're a cyber security solution, which is based on deep learning and machine learning capabilities.
The uniqueness of the solution is that we a very fast prevention. Right? We are self learned. We have very low false positive ratio And very special thing that we have is high accuracy of prevention of annual threats, which is very highlighted in the test and the results of the test that we had in this specific, evaluation.
Let me move to the next slide.
Not only that, we are not only an endpoint security solution. We also have, an agent that can be put on mobile or any server regardless the operation system.
We also have solutions for cloud infrastructure regardless if it's, backup or, cloud storage or any storage, that you have on your premises. And of course, other web applications that we have, a solution for. So we have many different, implementations that you can use our product to.
I'm gonna read moving to the next slide and, basically, giving an introduction to my colleague, Danielle, who's gonna be, explaining about the evaluation around five that happened right now.
Daniel, this stage is yours.
Thank you, Alex.
So first, let's, start with the my white white minor attack evaluation and want to participate in this evaluation.
So first, my third attack is, evaluation.
Is a a vendor evaluation that based on a attack framework. The attack framework is actually a known common language that, known across the whole security world, which is simplified attack chain of events.
This actually explained for those who less understand about the attack. How what actually happened on their environment if they have compromised.
In addition, The evaluation is based on real life APTs, which is relevant and active to the present day.
It's explained on, it's it's an emulation of a simulation on a real life TTP's knowledge.
And this is the only one actually.
Last, for both customers and vendors, this is a good way of benchmark.
For the customers, they actually can know, which vendor is more fit for them, most suitable for them. And for the for the vendors, they can understand, what are the blank spots.
Because again, because this is a real simulation, real tour and next to a real one.
Let's continue.
So how the test works?
The test is concluded, four days.
The two on Thursday, detection days, which are separated each one, for a different scenario.
Regarding to the APT that was chosen.
The the third day is that config change day again for the detection. And the last day is their protection as as Michael Econidact or prevention day, which is the same scenarios But for this one, you will have only, a check if it's blocked or locked.
Regarding the detection categories, the detection or categories is actually, how, every event got its own point. There is a system for Michael to to say, for each event, for each proven event that we show them.
What is the score that we got, against the the, pictures and, and, proof that we showed about the event itself. So we started form an a not applicable, which is the event the the execution one was was not a code, then none, which is, the execution of code, but we didn't have anything to show.
We, as I, as I, one of the vendors, telemetrial general, it's like, showing a little bit of information regarding this event that they showed.
But, it's like a surrounding event or, malicious that are abnormal, but without the mitre attack, framework.
And then the technique of the tactic, which the technique the technical technique, which technique is the highest call, with the attack, a micro framework on the event itself. Together with the information, of course, of the feasibility of the event.
As you can see over here, and, the prevention is as I said before.
Okay. So as you can see over here, there are a lot of participants in each year of this micro evaluation around, forty vendors, small and big, and We Deep is one of them.
Let's talk about the the APT that was chosen this year.
Who they are and why did they chose, but as they chose.
So toola.
First of all, there are very sophisticated attack group, which is still active.
And they were active, since two thousand and four, which is almost training years.
They have a lot of different systems, different scenarios different tools that they are using, which again helps monitor to simulate much more scenarios.
Tula had victim across the world, around forty five or more.
Countries around the world.
They are supported by the Russian government and the SSB. And here I'm I'm getting to the to the point why they are most relevant for this year, evaluation because they were involved in the Russian UK war.
There was a lot of, last articles about them in the last year. As you can see over here, and showing how to attack different, different places mostly in the curing.
Okay.
So as I said before, the the detection test and the prevention test was separated to two scenarios.
The first one was called cowbone. Why cowbone? Because this is a second stage backdoor and framework, which used by Tula to target governments.
So a little bit to explain about the scenario itself.
How, like, the the attack of chain was working.
So first of all, there was an initial initial access through the spear phishing.
The second step was fake installer that was downloaded and executed Epic.
Epic is a backdoor that used by Tula.
Then a persistent and CTO communication established, discover domain controller and ingress carbon GLL, which is part of carbon.
And last, it was moved literally, to the Linux Apache server.
This was the first scenario.
The second scenario is called snake, is known as also as a Rubers.
This is most sophisticated road kit that the f in the FSB arsenal that used by Tula.
Let's give dive about these scenarios as well.
So first, the, driver compromise with the action executed, Adobe Flash installer.
Bundle with Epic, again, with Epic, which installs the in the victim's network.
Second was, Epic communicate to the C2 server. Assist via process injection and performing evaluation, then snake is deployed to maintain foothold elevate privilege and communicate to the c two.
And last, lateral movement performed, to install light neuron, which is another back door that was used by Tula, to target their Microsoft Exchange servers, enabling them to collect and it's really trade sensitive email traffic.
Okay. So now let's go to the result. Alex, Yes. Thank you, Daniel. So, let's get deep dive into the results. So, first of all, I specifically took the last year evaluation.
And as you might see, last year, we have seventy percent of detection coverage.
This year, we had ninety percent of detection coverage. And This is very important to highlight at this point that seventy percent out of almost ninety steps was last year. And this year, we had ninety percent out one hundred and thirty steps. So when we gonna be talking about percentage between last year and this year, it is very important to highlight that one hundred percent change from scope of ninety steps to one hundred and thirty percent, which is almost, almost fifty percent more.
So, Daniel, wanna talk a bit about the comparison with other vendors.
Sure. I will take it.
So We took a little bit, pictures from the publicly available, market website.
There is, like, a section of comparison between several vendors in each scenario.
Here you can see uh-uh the scenario of day two, which is actually a very close one to the actual scenario that was used by Tula, from the beginning until the end.
I want to show you a little bit like highlighted, the tactics that we had, like, the most, success in, which is the initial access and the lateral movement.
And we have a little bit of comparison between us and different companies vendors that was participated.
Here you can see two of them.
And you you will have added two.
So again, the initial access and the lateral movement was, our strength.
Let let's go over the key takes. So First of all, we had more than ninety percent detection rate as Alex said before, which is a big, improvement from our last one.
Second, one hundred percent in letter of movement detection and initial malicious discovery.
That's what we're taking from that.
What happens to send in zero delay, real time detection. As you know, oh, dot no, actually. Myger is testing also a delay in the time of the showing event, of each execution, and we have one hundred percent of zero delay.
And last, there was like we said before, a significant improvement in detection, quality, and quantity.
In in a a year, we did this improvement, and we are hoping that in the next one, we'll have even more.
Okay. So let's go a little bit about the, scoring of the prevention and, our comparison to different, vendors as well. So let's go a little bit about the colors.
I didn't mention it before, but The, the purple one is like the in in detection it was technique, about the scoring that I told you before, which is the highest detection category.
And, yellow, it's none, which says that, nothing was happening in here, in this case, the prevent and it wasn't prevented.
And gray means that, it's not relevant. It's not applicable because this step was already executed and stopped blocked before that.
So here we have a little bit comparison between deep instinct and data to vendors.
And over here, you will have another two. Again, this is all, publicly available in the micro website. We didn't do any kind of comparison in our own, we just use their tool to do that.
Okay. So let's go over the key takes more than twenty nine ninety two percent prevention rate.
We have all prevention, we're blocked on the first steps which is, actually used. It's it's means that no mitigation needed on the victim device. Let's say that in in the first steps, the only, foothold is like the file was existed inside of the system in the computer. Which means that nothing was until yet executed.
So no mitigation will really be needed.
Let's continue.
Zero percent delay again in prevention and, one hundred percent static engine pre execution prevention.
What does that mean? Okay. So we have an engine, static engine, which is is pre execution.
It means that all the files that were execute, all the files that was getting in the system, was not yet executed and was not written even to the d which means that, let's say, for once on, when you will have get most of the, most of the solutions is like waiting for the ransom that will start to execute. They will see the behavior of the encryption, let's say, and the ransom note and only then the stop in that, which means that several of the files will be encrypted. In our case, there was a static blocking, which means that we will understand from the file from our, algorithm, which this kind of file was a gave to the system and then pre execution, we will prevent it. This is part of the solution, the AI solution that we have in the instinct.
Which is amazing. And again, all of the file, the the second scenario, let's say, was very similar to the real one by Tula but all of the files was executed in the test. We're commonly prepared by, constantly prepared by the biker ret team.
This means that it wasn't publicly available. And, we it's like we're taking this file to the unknown.
We haven't seen them before only by our AI and deep learning algorithms. We were able to stop them before they started.
Hey, Alex. You want to continue? Yes. Thank you, Daniel. So, we are getting for the conclusion part, and it's almost gonna be, the last slide before we move on to questions. So, first of all, it's very important to highlight that we provided excellent prevention and detection and visibility into all eighteen attacks.
As we mentioned before, it's a huge improvement from last year.
Going from seventy percent to ninety percent when the scope, became a lot bigger, almost a fifty percent. It's a very, something something to be crowding.
Another thing, we saw that our both prevention and detection engines receive excellent, coverage and visibility for all the techniques, especially those one that we highlighted before or for letter movement for privilege escalation, court, persistence, execution, and many others, but those are more extremely highlighted.
During the evaluation.
And, as Daniel mentioned before, which is also a big, spot that can differentiate us from other vendors that things that we prevented by the Dbrain static analysis engine, which is basically our patent.
All those things didn't succeed to writing the file to the Deeks. Which, shows how we're capable to deal with unknowns, based on machine learning and AI So those files as Daniel just explained, were not executed. They were stopped even before, because something that might trigger them.
I hope it was, explanatory enough, we will move move now into the question part.
So feel free to ask questions on on the sidebar.
I see one question from journal asking, What was the primary reason, for the improvement in detection quality and quantity? So, it's been about one in something years before, our last, evaluation.
We have done a lot of hard work, making our engine better both, during this year, both in development both in research, boast, almost in any aspect of, improvement.
Hopefully, it makes sense.
Moving to other question.
Is the beginning setting score one hundred percent of one, the evaluation like other vendors.
So, no, we're not gonna be, saying one hundred percent because it wasn't one hundred percent. It was above ninety two percent, and we used to stick to the truth It was above ninety two percent.
Let's see. Another question, how quickly deviencing those files compared to other brands. So, unfortunately, we don't have, any comparison to other vendors, but the thing I can highlight here that those files were blocked pre execution, which is the most important take here.
It was real time, meaning that instantly that during the evaluation, something was executed, we knew and found it on our clients, which means it happens almost instantly a new time of the first of all, in steps where the war execution detection, near near the execution, in prevention, almost even before, the evaluation even started. We all already knew that something happened.
This is removed from the causing damage to the death loss on the cost.
In other words, did you stop the initial compromise before entering the system like it yourself? Yes. We did.
I think we highlighted that that we block Asia access, but yes.
And that's what we meant stating that, we blocked everything on the first steps.
Okay.
So I I will I will say something about that if that's okay.
So my chair was splitting the whole scenarios, to substips, which means that the one and two and one and two steps, from the beginning of the prevention scenario was initial access, like the first one and the the one in the middle because it was related to the second scenario. But Actually, since they separated the scenarios, to several steps, from the second one until the end of the scenario, it was not the initial access. But let's say in a real world, we we did stop it in the initial access before it even started.
But then again, you can see our in our results, for the whole prevention scenarios that we did do, as like a prevention as fast as as we can in in the first steps which means that even in the if if it's like bypass the initial access, it was stopped in the execution of this file and, etcetera.
And when we when we are saying that it was stopped in the static engine which means that every file that was coming and was scanned and found out to be malicious was stopped. Okay. So most of our, blocking in this protections and prevention, test we'll stop by our static engine. And that's what we are saying here.
Yep. Thank you, Alex.
Thank you, Daniel. Another question, how do you spend the potential customers that they can send you a ninety day prevention while others So it's very good question. And I have a duty to ask.
So first of all, in this specific task that, caused us to lose this eight percent we blocked what was executed.
And basically in real life, there would be and there was alert, in the system, and it was blocked. The only thing that the file, was not, removed from the system, and we had a dispute with Miter, which was unfortunately wasn't accepted, but, that's why we lost eight percent.
Hope it makes sense.
Any other questions?
Okay.
Since there are no questions anymore, I would like to thank you for, sharing, sharing your time with us and, participating in that webinar.
Hope you will have a nice weekend and see you next time. Bye bye.
Thank you.