Notes from the Field: Extending Carbon Black Visibility to Undetected Malware

The answer was quite interesting and one that I wanted to share with our blog readers.

The company (we’ll call them NA Bank for confidentiality) had Carbon Black deployed on their endpoints and by all measures the deployment was a great success. They had even utilized Carbon Black to uncover and thwart a recent series of targeted malware attacks on the company.

“Why do you think this was a targeted attack?”, I asked.

She responded that the files related to the attacks were never flagged by AV as malware, and that their file intelligence feeds showed no IOCs that matched what they were tracking. In her view, this was truly unknown malware.

My next logical question was how did Carbon Black detect the attack?

The Director explained that the Carbon Black Predictive Security Cloud and unfiltered approach to machine learning was the key. This technology had surfaced the anomalous behaviors (the behavioral IOCs) of the attack in its early stages even when traditional signatures had failed.

My next question was about the malware samples - if they had any idea what they were or had done any manual analysis.

The answer - she did not know at the time and found that it was very difficult to figure it out. “We isolated 5 files related to the attack”, she explained, “but none of the files were executables so we could not use our sandbox. That is when you folks (ReversingLabs) came into the picture.”

The security director explained to me that they had recently lost their two most experienced security analysts to a larger company and they were the only two who understood the process to reverse engineer the files (including the process of static analysis). Her next step was to reach out to a consulting firm and have them analyze the files.

That raised another question; since Carbon Black had picked up the IOCs and could stop the attack, why was it so important to identify the malware?

The answer was simple, “So that my team can make sure other payloads from these recent attacks or other future attacks that utilized the same or similar malware could be quickly identified. We don’t want to spend time investigating something we should already know”, the director explained. “Instead, when we identify the same or a similar attack in the future, we want to quickly execute a response playbook that stops the attack quickly and with minimal business disruption. That requirement also led us to ReversingLabs.”

“That makes sense”, I said. “So, what were the requirements that made ReversingLabs a good fit for this problem?”