CrowdStrike Counter Adversary Operations is committed to analyzing active exploitation campaigns and detecting and blocking zero-days to protect our customers. In July 2023, the CrowdStrike Falcon® Complete managed detection and response (MDR) team discovered an unknown exploit kit leveraging a still-unknown vulnerability affecting the Windows Error Reporting (WER) component. … [Read more...] about Falcon Complete: Zero-Day Exploit Case Study
Falcon
Falcon Complete MDR Thwarts VANGUARD PANDA Tradecraft
VANGUARD PANDA Background On May 24, 2023, industry and government sources detailed China-nexus activity in which the threat actor dubbed Volt Typhoon targeted U.S.-based critical infrastructure entities. CrowdStrike Intelligence tracks this actor as VANGUARD PANDA. Since at least mid-2020, the CrowdStrike Falcon® Complete managed detection and response (MDR) team and the … [Read more...] about Falcon Complete MDR Thwarts VANGUARD PANDA Tradecraft
Native XDR for ChromeOS on Falcon Platform
In recent years, ChromeOS device usage among businesses has seen a significant uptick, particularly in its adoption across verticals, from schools to large enterprises. According to recent IDC research, 16% of North American organizations have ChromeOS devices1 and the percentage is only expected to increase. The success of ChromeOS devices like Chromebooks can be attributed to … [Read more...] about Native XDR for ChromeOS on Falcon Platform
Augment or Replace SIEM with Falcon Platform
In Part 1 of our SIEM blog series, we discussed the state of SIEMs today and how CrowdStrike Falcon® LogScale solves five key SIEM use cases while improving security outcomes and cost savings compared to traditional SIEMs. Our conversations with customers have made it clear: SIEM requirements don’t stop at the five use cases covered in that blog. Modern SIEM systems extend … [Read more...] about Augment or Replace SIEM with Falcon Platform
Falcon Discover Enhanced with Application Inventory
CrowdStrike Falcon® Discover delivers deep asset visibility with no hardware to deploy or manage, providing valuable context for all of your assets. For IT and security teams alike, Falcon Discover is a powerful tool to stop breaches. The majority of CrowdStrike customers already use Falcon Discover to improve their IT and security posture. To continue providing them with … [Read more...] about Falcon Discover Enhanced with Application Inventory
Falcon Intelligence Recon+ and the Dark Web
The vastness of the deep and dark web can easily turn attempts to monitor for cyber threats into a firehose of useless information. Part of the problem is the nature of the data streams that need to be monitored. Every day, more credentials are stolen and exposed. Illegal criminal forums are full of repeated spamming of illicit advertisements. Thousands of new domain names are … [Read more...] about Falcon Intelligence Recon+ and the Dark Web
Mitigate Cyber Risk From Email With the Falcon LogScale and Mimecast Integration
Email is the top initial attack vector, with phishing campaigns responsible for many damaging cyber attacks, including ransomware. Being able to search Mimecast email security logs in CrowdStrike Falcon® LogScale (formerly known as Humio), alongside other log sources such as endpoint, network and authentication data helps cybersecurity teams detect and respond to cyber … [Read more...] about Mitigate Cyber Risk From Email With the Falcon LogScale and Mimecast Integration
How to Ingest Data into Falcon LogScale Using Python
This post covers how to ingest data into CrowdStrike Falcon® LogScale from your MacOS platform using Python. This guide is great for setting up a one-node proof of concept (POC) so you can take advantage of LogScale’s free trial. Before you can write your ingest client, you must prepare a good foundation. That means preparing your MacOS instance via the following … [Read more...] about How to Ingest Data into Falcon LogScale Using Python
A Sneak Peek at the 2022 Falcon OverWatch Threat Hunting Report
Another turbulent year for cybersecurity finds itself right at home alongside global economic headwinds and geopolitical tensions. This year has been defined by rampant affiliate activity, a seemingly endless stream of new vulnerabilities and exploits, and the widespread abuse of valid credentials. These circumstances have conspired to drive a 50% increase in interactive … [Read more...] about A Sneak Peek at the 2022 Falcon OverWatch Threat Hunting Report
Getting Started Guide: Falcon Long Term Repository
Limited data retention resulting from financial or technological constraints makes it hard for security teams to see the complete history of an attack. This lack of full context about a threat — or a potential threat — eventually catches up with organizations, leading to longer dwell times and increased risk of a breach. CrowdStrike Falcon Long Term Repository (LTR), formerly … [Read more...] about Getting Started Guide: Falcon Long Term Repository