The document discusses the need to quickly investigate security alerts from across a network. It proposes automatically deploying agents across systems to scan for suspicious modules in real time. This would allow starting investigations within seconds of an alert, collecting evidence from any host, and getting actionable data to respond. The system would then automatically detect and react to potentially infected modules.

1. Or Cohen – We Ankor 2014
or@we-can.co.il

2. Saturday, May 17, 2014 slide 2
• Many daily alerts, even after advanced aggregation and correlation.
• Investigating a server/workstation is not always possible due to lack
of physical access, tools, time or knowledge.
• Just starting an investigation may take hours or even days – long
after the initial alert was triggered.
• Relevant evidence are hard to collect and analyze.

3. • Start an investigation for every single alert within seconds.
• Get to every host in the network regardless of physical location.
• Collect and analyze relevant evidence.
• Get actionable and refined data from the investigated host ASAP.
Saturday, May 17, 2014 slide 3

4. • Automatically deploy (and remove) ECAT agents across the network.
• Automatically scan hosts with multiple scan configurations.
• Automatically collect scan results from ECAT with full analysis data.
• Automatically react to the presence of a suspicious module.
Saturday, May 17, 2014 slide 4

5. Saturday, May 17, 2014 slide 5
Now what?

6. Saturday, May 17, 2014 slide 6
Install ECAT Agent OnWS87771

7. Saturday, May 17, 2014 slide 6

8. Saturday, May 17, 2014 slide 6

9. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
Module Path: C:$Recycle.BinS-1-5-21-1844237615-1604221776-
725345543-151746re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860
Host Name: WS8771
Host IP: 10.2.34.123
Bytes In: 3211
Bytes Out: 7651819
Target IP: 27.1.34.79
Target Host: superEvil.info
Target Port: 21
OPSWAT Verdict: Clean
YARA Verdict: Infected - super_evil_malware_group
Certificate Status: Not Singed
HASH Lookup: Unknown
S.L: 49
Comment:Found Infected on 19/05/2014 by:
super_evil_malware_group

10. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

11. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860
WS8291
WS8101
WS2151
iexplore.exe
svchost.exe
tempp.exe

12. Saturday, May 17, 2014 slide 6
WS8291
WS8101
WS2151
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

13. Saturday, May 17, 2014 slide 6
AVVendor
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

14. Or Cohen – We Ankor 2014