Publications

Managed detection and response in 2021

Kaspersky Managed Detection and Response (MDR) helps organizations to complement existing detection capabilities or to expand limited in-house resources to protect their infrastructure from the growing number and complexity of threats in real time. We collect telemetry from clients’ networks and analyze it using machine learning and artificial intelligence, plus human threat-hunting analysts. Kaspersky SOC investigates alerts and notifies the client if there is something bad going on, providing response actions and recommendations.

MDR in 2021 in numbers

In 2021:

  • Kaspersky MDR received 414K alerts.
  • 63.74% of received alerts were processed by SOC analysts, 6.67% of which were related to real incidents reported to customers via the MDR portal
  • 77.4% of all incidents are related to only one alert
  • 14% of incidents were high-severity, 66% medium-severity, and 20% low-severity
  • The average identification time of high-severity incidents was 41.4 minutes
  • 40.7% of high-severity incidents were targeted attacks; 18% were ethical offensive exercises (penetration testing, red teaming etc.)
  • Most incidents were detected at the initial access (27.3%) and lateral movement (16.3%) stages
  • Most often high-severity incidents were detected in IT (39%), industrial (30.2%), and financial (29.1%) organizations
  • The LOL binaries most often used by attackers were cmd.exe, powershell.exe, and rundll.exe

To get the full Kaspersky Managed Detection and Response 2021 report, please fill out the form below.

Managed detection and response in 2021

Your email address will not be published.

 

  1. Cristian

    Brunello Cucinelli Spa

    1. Securelist

      Hi Cristian!

      You filled in the comment form instead of PDF download form. If you cannot see the latter, please, try to add this page to exceptions in your browser settings and/or ad blocker.

Reports

The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox