CrowdStrike 2021 Threat Hunting Report – The Findings

Goran Lepan

Blog

24 September 2021

Each year, CrowdStrike releases its Threat Hunting Report to provide insights into adversary tactics, highlight notable breaches and provide recommendations on how to better protect your business. In last year’s report, key findings clearly focused on the rising cyber threats in response to the COVID-19 crisis. However, a year on, with work-from-home practices firmly in place, there has been little reprieve from escalating threats. In fact, the past year has laid witness to some of the most serious and widespread cyber attacks yet.

This year’s report looks closely at threat actor behaviours, referred to as intrusion activity. It then uses the data to examine how threat actors are operating in their victim’s environment, shining a spotlight on both common and unusual techniques that are being employed. To help you digest the information, in this article, we’ll summarise the key findings and recommendations from the report. This way, you can be aware of what your business is facing and how best to protect it from current and emerging threats.

Key Findings

Over the past 12 months, intrusion activity has continued at record levels. Both eCrime and targeted intrusions have evolved and matured their tactics in an attempt to trick their victims. Moreover, once adversaries gain access, they are becoming more adept at moving silently through networks to cause maximum damage. Some key trends your business should be aware of include:

• Increasing intrusion activity – the study tracked a 60% increase in interactive intrusion activity across all industries and geographic locations.
• Rising sophistication of attacks – adversaries have moved beyond malware, with 68% of attacks being malware-free. Instead, innovative techniques are being used to evade detection.
• Continuing domination of eCrime – eCrime made up 75% of intrusion activity driven in part due to the evolution of big game hunting.
• Escalating speed of attacks – adversaries moved more quickly, moving laterally within a victim’s environment in an average of 1 hour and 32 minutes.
• Enduring threat of targeted instructions – state-sponsored activity continues to be a large threat, particularly to the telecommunication industry, which accounted for 40% of the attacks.

Recommendations

By going head-to-head with adversaries on a daily basis and developing in-depth insights, CrowdStrike has been able to build defensive recommendations on how to protect your business. With no sign of targeted adversaries slowing down, it’s vital to consider:

• Endpoint protection – adversaries are becoming increasingly skilful at finding blind spots in security coverage; full endpoint protection across all devices is key if you are to stop adversaries operating in the dark.
• Correct configuration – it is vital to have security measures and prevention capabilities in place, but if they aren’t configured properly, they won’t hold adversaries back.
• Ability to act – adversaries will always be looking for new ways to breach your organisation and move within your environment. You must remain aware and ready to act at all times as well as hunt the threat actors within your environment.
• Good hygiene – you need to have control over the software your business uses, ensuring your environment is up to date with the latest patches and that any unrequired software is removed.
• Identity protection – ensure valid credentials don’t fall into the wrong hands by enforcing strong password policies. Multi-factor authentication (MFA) should be employed, sensitive information should never be kept in unencrypted files, and the principle of least privilege access should be used.
• Remote access – eCrime actors often use tools such as TeamViewer, AnyDesk or VNC; as such, use of these tools should be audited and restricted. All externally accessible services should be closely monitored to prevent common exploit attempts due to exposed SMB and RDP ports to the internet.

Protecting Your Business

There is no sign of adversaries slowing down in their attempts to evade defences and cause damage within a victim’s environment. However, with the right insights, tools and support, your business can prevent most of today’s sophisticated intrusions. Furthermore, by developing and learning from insights, you can ensure that you continuously improve your security measures to stay ahead of tomorrow’s threats. To find out more about what you’re up against and how to protect your business, download CrowdStrike’s Threat Hunting Report today.

Business Email Compromise

Data Loss Prevention

Findings Report

Phishing

Ransomware

Endpoint Detection Response

Threat Hunting

Share