Behind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
summary
Cloud ransomware examples and numbers: 1,200 ElasticSearch databases publicly ransomed last year; a crypto‑miner that spiked AWS bills ~$45,000 while the attacker earned ~$800; WatchTower tracks ~808.5 million IOCs. A customer produced 1.1 million storylines, 21,000 suspicious, 15,000 auto‑remediated, 6,000 triaged and only 32 escalated. Demo shows an IBM Faspex pre‑auth RCE leading to wget of iFire and demo binaries, but SentinelOne’s behavioral AI engine severs the SSH and blocks encryption in under a second while capturing CLI commands and the ransom passphrase.
AI-written summary · about
chapters (8)
- 0:00Introduction and agenda
- 0:36Cloud incident causes
- 1:43Impacts of cloud incidents
- 3:31Threat research and services
- 6:31Real-world incident play-by-play
- 8:48Demonstrating attack mitigation
- 10:57Platform architecture
- 13:12Key takeaways and conclusion
related talks
13mUsing AI to thwart cloud ransomware
52mRansomware; The Real Pandemic
40mRansomware Threat Landscape
54mExperience a simulated ransomware event: Learn now to prevail later
37mRansomware Resilience: Holistic Defense for SOC Leaders
33mLiving with Ransomware - The New Normal in Cyber Security
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
18mSecuring cloud innovation: Lessons learned