Track the Entire Threat Lifecycle with ExtraHop + FireEye TAP

Visibility gets you many things: high-performing applications, faster remediation and, perhaps most importantly, peace of mind. That's why we're super excited to show off our recently announced partnership with the FireEye Threat Analytics Platform (TAP). Taking advantage of the ExtraHop Open Data Stream, we combine industry-leading security expertise from FireEye with the ExtraHop platform's unprecedented wire data visibility.

In the video above, I walk through an example security event and show how the ExtraHop-FireEye integration enables you to track the attack from the initial compromise to the final data exfiltration:

1. A malicious actor from a known bad domain/IP sends a phishing email message with a malicious attachment. This is a common method for gaining initial system access, alongside stolen credentials or internal bad actors.
2. An unsuspecting user opens the attachment, and their host is compromised.
3. The compromised host downloads a rootkit from the same bad domain over HTTP, which then replaces common utilities and disables all logging.
4. The rooted host builds an outbound SSH connection to use as a reverse tunnel for command and control. Although firewalls block inbound SSH connections, outbound connections are often allowed.
5. The malicious actor scans the network for potential database targets using, for example, an Nmap TCP-SYN scan, a type of stealth port scan that avoids the full TCP three-way handshake.
6. Once an unsecured, internal database is found, the malicious actor tries common username/password combinations to identify possible points of access.
7. With successful credentials, the malicious actor queries the database for sensitive data.
8. After the sensitive data is found, the attacker uploads it to a hosted FTP server (hosted at the same origin IP) and then kills all connections.

Watch the video to see how the combination of ExtraHop wire data analytics and the FireEye TAP help you detect and investigate this type of threat. Specifically, this technology integration enables you to:

• Use FireEye to identify and alert on malicious characteristics in HTTP request and response metrics from ExtraHop, such as md5 fingerprints, IP addresses, and domains.
• Investigate other events related to the source IP address, such as email messages with large attachments and outbound SSH connections.
• Investigate the contextual communications of the target host using ExtraHop, including a flood of ICMP traffic and a high number of TCP SYNs sent without corresponding connections established. Combined, these communications indicate an Nmap TCP-SYN scan.
• Verify suspicious SSH and HTTP activity in ExtraHop, and examine unusual database communications that show a spike in data requested as well as Access Denied errors with common database usernames. The ExtraHop platform can even expose the exact SQL query that resulted in the large database response.
• Switch over to FTP communications for the targeted host to see a large FTP upload to the attacking IP address. With the ability to see which database was accessed and which queries used, you can take appropriate steps to address the data leakage.

Read about the ExtraHop platform's security and compliance capabilities.

Ideally, this attack would be stopped by antivirus software or a firewall, but the ExtraHop-FireEye TAP integration equips you to identify and stop an attacker that makes it through a hardened perimeter. With real-time alerting and powerful forensic capabilities at your fingertips, you can help to mitigate the cost to your business.

Interested in learning more? Download our ExtraHop+FireEye datasheet or contact our field team.