ThreatDown earns highest ratings across EDR and MDR categories in G2 Winter 2024 results

The peer-to-peer review source G2 has released its Winter 2024 reports, ranking ThreatDown products on top across several Endpoint Detection and Response EDR and Managed Detection and Response MDR categories. Based on verified customer reviews, ThreatDown EDR was voted a Leader in the overall and...

EDR vs MDR vs XDR

In the realm of security measures within the digital expanse, we recurrently stumble upon designations, namely, EDR Endpoint Detection and Response, MDR Managed Detection and Response, and XDR Extended Detection and Response. These abbreviations express singular methodologies fashioned to augment...

PT-2023-20554 · Watchguard · Watchguard Epdr

Name of the Vulnerable Software and Affected Versions: WatchGuard EPDR version 8.0.21.0002 Description: An issue was discovered in WatchGuard EPDR, where it is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. Recommendations: For WatchGuard EPDR version 8.0.21.000...

WatchGuard EPDR Security Vulnerability

WatchGuard EPDR is an application from WatchGuard USA, Inc. prevents, detects and responds to any type of known and unknown malware as well as fileless and malware-free attacks. A security vulnerability exists in WatchGuard EPDR version 8.0.21.0002, which stems from a weak implementation of...

Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

Actions to take today to mitigate malicious cyber activity: 1. Patch all systems for known exploited vulnerabilities KEVs, including firewall security appliances. 2. Monitor for unauthorized use of remote access software using endpoint detection tools. 3. Remove unnecessary disabled accounts and...

MDR: Empowering Organizations with Enhanced Security

Managed Detection and Response MDR has emerged as a crucial solution for organizations looking to bolster their security measures. MDR allows businesses to outsource the management of Endpoint Detection and Response EDR products deployed across their network domain. With real-time threat-hunting...

2022 Top Routinely Exploited Vulnerabilities

SUMMARY The following cybersecurity agencies coauthored this joint Cybersecurity Advisory CSA: United States: The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, and Federal Bureau of Investigation FBI Australia: Australian Signals Directorate’s Australian Cyb...

Have you been compromised?

Imagine the scenario… A nation state recruits an asset / spy at age 18. Their education and living expenses are fully funded, all with the aim of getting them a job at a target organisation. All goes to plan, on paper they’re a good fit and they get a low profile graduate role in the company. Lif...

From Malvertising to Ransomware: A ThreatDown webinar recap

Our recent webinar From Malvertising to Ransomware highlight the clear connection between malvertising--the practice of embedding malicious code within legitimate online advertisements--and the epidemic of ransomware attacks affecting businesses globally. Presented by Mark Stockley, security...

Forrester names Microsoft a Leader in the 2023 Enterprise Email Security Wave

In today’s rapidly evolving connected workplace, where hybrid and remote work are increasingly the norm, workplace productivity and communications tools like email and chat applications are more important than ever. However, cyberthreats continue to evolve with increasing capabilities and...

Employee guilty of joining ransomware attack on his own company

A 28-year old IT Security Analyst pleaded guilty and will consequently be convicted of blackmail and unauthorized access to a computer with intent to commit other offences. It all started when the UK gene and cell therapy company Oxford BioMedica fell victim to a cybersecurity incident which...

Ransomware Hackers Using AuKill Tool to Disable EDR Software Using BYOVD Attack

Threat actors are employing a previously undocumented "defense evasion tool" dubbed AuKill that's designed to disable endpoint detection and response EDR software by means of a Bring Your Own Vulnerable Driver BYOVD attack. "The AuKill tool abuses an outdated version of the driver used by version...

Secure your business like you secure your home: 5 steps to protect against cybercrime

Running a business requires a lot of determination and sometimes a leap of faith. Every day brings a new challenge, and many times it can feel like the stress and uncertainty are too much. That’s when you remind yourself why you took the leap—the satisfaction of realizing your own vision—and you...

Secure your business like you secure your home: 5 steps to protect against cybercrime

Running a business requires a lot of determination and sometimes a leap of faith. Every day brings a new challenge, and many times it can feel like the stress and uncertainty are too much. That’s when you remind yourself why you took the leap—the satisfaction of realizing your own vision—and you...

Guidance on Microsoft Signed Drivers Being Used Maliciously

Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program were being used maliciously in post-exploitation activity. Microsoft has completed its investigation and determined that the activity was limited to the abuse of several...

Threat Source newsletter (Dec. 8, 2022): Your uncle clicked every link

Welcome to this weeks edition of the Threat Source newsletter. As we hurtle toward the end of another year I get that tightness in my chest - that feeling that I think most, if not all, Threat Source readers get at this time of year. Thats right, its once again the time of year when no matter wha...

Symantec Endpoint Detection And Response 安全漏洞

Broadcom Symantec Endpoint Detection And Response is an endpoint security detection and response solution from Broadcom. A security vulnerability exists in the Symantec Endpoint Detection And Response SEDR Appliance prior to version 4.7.0, which stems from susceptibility to elevation of privilege...

CVE-2022-37015

Symantec Endpoint Detection and Response SEDR Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected fro...

CVE-2022-37015

Symantec Endpoint Detection and Response SEDR Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected fro...

PT-2022-23759 · Symantec · Symantec Endpoint Detection/Response Appliance

Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Detection and Response SEDR Appliance versions prior to 4.7.0 Description: The issue is a privilege escalation vulnerability, which allows an attacker to attempt to compromise the software application to gain elevated access...