Darktrace/Cloud Use Cases

Embrace the cloud, manage the risks.

Operating in a cloud or hybrid environment can introduce risk from both external and internal sources. Darktrace/Cloud is built to address threats across your entire cloud infrastructure.

Ransomware

Ransomware is a multi-stage attack that starts with a compromised device and ends in encryption and a ransom note. Darktrace/Cloud takes targeted action at every stage of the attack.

Initial Intrusion


Darktrace has revealed well-known exploits such as Log4J, Hafnium, Kaseya, as well as thousands of lesser-known exploits on a regular basis.

DARKTRACE - Better Together

Even better when deployed with:
Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this stage of attack:
Unusual Incoming RDP
Unusual File Download
Unusual .exe File Torrenting
Application Protocol to Uncommon Port
Large Numbers of Connections to New Endpoints

Establish Foothold and Beaconing

When an attacker attempts to make contact with and remotely control a device, Darktrace pieces together subtle anomalies.

Darktrace RESPOND/Cloud neutralizes this activity blocking specific connections or enforcing the ‘pattern of life’

Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this type of attack:
Beaconing to a Young Endpoint
Anomalous File Downloads
Unusual Data Download / Upload
Beaconing Activity to External Rare Endpoint
Connections to Unusual Endpoint

Lateral Movement

As an attacker begins to increase their knowledge of the network, perform scans, and escalate their privileges - for instance by obtaining admin credentials, DETECT/Cloud correlates thousands of data points.

Darktrace RESPOND/Cloud neutralizes this activity blocking specific connections or enforcing the ‘pattern of life’

Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this stage of attack:
Unusual SMB Enumeration
Suspicious Network Scan Activity
Unusual Admin SMB or RDP Sessions
New or Uncommon Service Control
Unusual SSH

Data Exfiltration

Whether smash and grab or a low and slow, DETECT/Cloud identifies subtle deviations in activity.

Darktrace RESPOND/Cloud neutralizes this activity blocking specific connections or enforcing the ‘pattern of life’

Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this type of attack:
Anomalous 
SMB Traffic
Uncommon 1 GiB Outbound
Data Sent to Rare Domain
Unusual External Data Transfer
Unusual Data Download / Upload to Rare Destination

Data Encryption

Even if familiar tools and methods are used to conduct encryption - whether symmetric or asymmetric - Darktrace detects the activity without using static rules or signatures. It identifies unusual behavior that may include:

Darktrace RESPOND/Cloud neutralizes this activity blocking specific connections or enforcing the ‘pattern of life’

DARKTRACE - Better Together

Even better when deployed with:
Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this stage of attack:
Additional Extension Appended to SMB File
Suspicious SMB Read/Write Ratio
Sustained MIME Type Conversion
Possible Ransom Note
Suspicious SMB Activity

Insider Threat

Whether a malicious leaver or a careless employee disregarding company policy, Darktrace’s understanding of normal patterns of life allows it to stop threats on the inside.

DARKTRACE - Better Together

Even better when deployed with:
Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this type of attack:
Sustained SSL and HTTP Increase
ICMP Address Scan
Uncommon WMI Activity
Numeric Exe Download
Anomalous File Download
Suspicious SMB Activity
Multiple Unusual File Uploads
Suspicious SMB Read/Write Ratio
Fast Beaconing to DGA

Supply Chain Attack (Third Party Software Vulnerability)

Darktrace stops threats arising from the supply chain by taking immediate action at the first sign of unusual and threatening activity.

DARKTRACE - Better Together

Even better when deployed with:
Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this type of attack:
SSL Beaconing to New Endpoint
Multiple Uncommon New Credentials on Device
New or Uncommon Service Control
Anomalous SMB Followed By Multiple Model Breaches
Anomalous SMB to New or Unusual Locations

Crypto-Mining

Malicious crypto-mining is notoriously difficult to detect, and can exploit cloud platforms at great cost to the organizations deploying them.

Darktrace shines a light on open ports and internet-facing devices you didn’t know about, and detects the first stages of an attack before crypto-mining can even begin. It also alerts to crypto-mining activity itself, and can be configured to stop the activity autonomously.

Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing this type of attack:
Crypto Currency Mining Activity
Slow Beaconing Activity to External Rare
Suspicious Beacons to Rare PHP Endpoint
SMB Drive Write

Credential Harvesting

Credential stuffing is a type of brute-force attack that relies on automated tools to test large volumes of stolen usernames and passwords across multiple sites until one works.

In the cloud space, Darktrace can detect credential stuffing through a number of unusual behaviors - and respond to the account following it.

DARKTRACE - Better Together

Even better when deployed with:
Sample analysis of Darktrace/Cloud
Every threat is different, but here are some examples of unusual behaviors Darktrace may detect to uncover a credential harvesting attack:
Anomalous Uncrypted Credential Over HTTP
Kerberos Username Bruteforce
Unusual External Source for Credential Use
Darktrace may then detect the following unusual indicators of attack immediately following a successful credential harvesting attack:
Spike in Compute Resources Created
Unusual AWS Policy Attachment
...

Mergers & Acquisitions

Darktrace/Cloud makes it simple to incorporate new cloud environments into your company infrastructure without opening vulnerabilities.

Sample analysis of Darktrace/Cloud
Every threat is different, but here are some unusual patterns Darktrace/Cloud might assess when revealing an attack related to mergers & acquisitions:
Sustained SSL and HTTP Increase
ICMP Address Scan
Uncommon WMI Activity
Numeric Exe Download
Anomalous File Download
Suspicious SMB Activity
Multiple Unusual File Uploads

An Unlimited Number of Attacks

An Unlimited Number of Responses

귀하의 비즈니스에 좋은 소식입니다.
나쁜 사람들에게 나쁜 소식입니다.

무료 평가판 시작

무료 평가판 시작

유연한 배송
가상환경에 설치하거나 하드웨어에 설치할 수 있습니다.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
For more information, please see our Privacy Notice.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
YOU MAY FIND INTERESTING
양식을 제출하는 동안 문제가 발생했습니다.

Get a demo

유연한 배송
가상환경에 설치하거나 하드웨어에 설치할 수 있습니다.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
감사합니다! 제출되었습니다!
양식을 제출하는 동안 문제가 발생했습니다.