Securing a New Way of Working: Wait, What’s This Thing Running on Your Machine?

By George Panousopoulos

With more and more users working remotely, it is highly likely that more apps will be downloaded and installed onto the endpoints. Here is an analytic story from the Splunk Enterprise Security Use Case Library.

Analytic Story: Monitor for Unauthorized Software

This story provides guidance to identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. There is a similar Analytic story to monitor out of date software as well. Consider that the risk of installing more software in the endpoints will be higher. Also, if you are already using this search, consider reviewing the frequency at which this is run, as with the new operations model the specific requirement will most likely change.

Example searches include among others Prohibited Software on Endpoint, Get Authentication Logs for Endpoint, Get Vulnerability Logs for Endpoint, Investigate Web Activity From Host, and Add Prohibited Processes to Enterprise Security. For each one of these, users can edit the correlation search as shown below for the Prohibited Software on Endpoint one:

Tha main data source type for this Analytic Story is EDR, including the likes of Carbon Black, Tanium, CrowdStrike, and Sysmon.

Check here for more practical guides on how to secure your organization in the new work-from-home era.

Thanks to the contributors of this blog post, Bryan Sadowski, Lily Lee, Rene Aguero, James Brodsky, Chris Simmons.

Nation-State Espionage Targeting COVID-19 Vaccine Development Firms - The Actions Security Teams Need To Take Now!

The UK NCSC published an advisory report that threat group APT29 most recently targeted organizations which are involved in COVID-19 vaccines development and testing. Find out if your organization is affected and which actions you need to take now.

Security 3 Min Read

Using Splunk for Your Vulnerability Management

Security 3 Min Read

Splunk Enterprise Security 7.3 Delivers a Refined Analyst Experience and Enhanced Risk Context for Seamless Incident Triage

Announcing Splunk Enterprise Security 7.3, delivering a refined analyst experience and enhanced risk context for seamless incident triage.

About Splunk

The world’s leading organizations rely on Splunk, a Cisco company, to continuously strengthen digital resilience with our unified security and observability platform, powered by industry-leading AI.

Our customers trust Splunk’s award-winning security and observability solutions to secure and improve the reliability of their complex digital environments, at any scale.