Log4J Attack Contained In Minutes

Velocity MXDR Deployed To Expand Threat Detection And Monitoring

The client had previously engaged Sygnia to contain and eradicate an attacker, including deployment of Sygnia’s Advanced Monitoring for post-breach surveillance. The client then leveraged Sygnia’s posture analysis service to assess its resilience to cyber attacks, including identification of specific security strengths and exploitable vulnerabilities.
The client used the posture analysis to embark on a process of continuous improvement of its security posture and defensive capabilities. Within that context, the client decided to expand its threat detection and monitoring capabilities and deployed Sygnia’s Velocity MXDR.

Shortly After Deployment, Velocity Detects A Major Attack

Shortly after MXDR deployment, a threat-actor launched a Log4J attack against the client. A backup server with critical, confidential operational data was targeted.

Attack Timeline

T +0 Min: Attack Detected
During the evening hours, Velocity’s XDR detected a suspicious LDAP request from the customer’s backup server. Based on its detection scenarios, Velocity issued an alert to Sygnia’s MXDR analysts that indicated a possible Log4j exploitation at the client.

T +05 Min: Containment recommendations communicated
The MXDR team analyzed the logs to validate the Log4j exploit attempt. Leveraging Sygnia’s global threat database, the team confirmed that the attacker’s IP address was associated with multiple attacks, including other Log4j attacks. The MXDR team communicated the findings to the client and recommended immediate actions to isolate the targeted backup server and block the attacker.

T + 08 Min: Attack Contained
The customer’s security team implemented Sygnia’s recommendations and blocked the attacker.

T + 12 Min: Threat-hunt Completed
To assess the full scope of compromise, Sygnia’s Velocity team conducted a network-wide search for attack indicators. The investigation included a detailed inspection of the backup server to find traces of other suspicious commands that may have preceded the initial alert.

T + 30 Min: Investigation Summary and Recommendations Issued
The investigation confirmed that there were no additional attack indicators. An investigation summary report was sent to the client, including findings and recommendations for further mitigation actions to eliminate the Log4j vulnerability. The client implemented Sygnia’s remediation recommendations.