TermDefence

Extended detection and response

(XDR)

A detection and response approach that combines and correlates security events from endpoints, email, identity, network and cloud in one place.

Flow

1Sources are connected
2Events are correlated
3Response is taken

Related families: —
MITRE ATT&CK: T1078 · Valid Accounts
Sources: 5 sources

Overview

Endpoint detection and response sees only the device. The extended approach also brings together the traces of the same incident in email, the identity system and the network. NIST CSRC

This combination matters in infostealer incidents: the infection happens on the device, but the sign-in with the stolen identity happens in the cloud service. Google Cloud (Mandiant)

How it works

1
Sources are connected
Endpoint, email, identity and network events are collected.
2
Events are correlated
Traces belonging to the same user and device are merged into one incident.
3
Response is taken
The device is isolated, sessions are ended and the account is locked.

How to detect it

Match the user of the device where the infection was seen with cloud sign-ins from unusual locations. Google Cloud (Mandiant)
A sign-in with a valid account looks normal on its own; it becomes meaningful when combined with the infection record on the device. MITRE ATT&CK

What to do

Bring the identity system and cloud services into detection scope. Google Cloud (Mandiant)
For the user of an infected device, end sessions and re-enrol multi-factor authentication. MITRE ATT&CK