CrowdStrike has introduced AI-backed indicators of Attack (IoAs). It is a new innovation for fileless attack prevention at scale and enhanced visibility for stealthy cloud intrusions. These new detection and response capabilities are delivered on the CrowdStrike Falcon platform and are backed up by the CrowdStrike Security Cloud. All these features can also be used to stop any upcoming attack techniques and allow organizations to optimize their threat detection and response cycle with accuracy, scale, and pace.
Around 10 years ago, CrowdStrike created IoAs which introduced a new approach for stopping breaches based on real adversary behavior, without giving importance to the type of malware or exploit used to conduct the attack. In addition, CrowdStrike has also tried to overperform in applications of AI in cybersecurity to figure out and restrict highly advanced emerging attacks.
Talking about the current scenario, CrowdStrike is focusing on taking advantage of AI techniques to develop the latest Indicators of Attack at machine scale and speed.
CrowdStrike Falcon
The Falcon platform’s new capabilities would consist of the following:
AI-Powered IoAs
Organizations these days are in pressure of defending against the expanding attacks that surface against the emerging threats and adversary tradecraft. With the Falcon platform, organizations will be able to:
- Identify new attack classes at a faster pace – Find emerging attack techniques with new IoAs created by continuously learning AI models trained on real-world behavior and the world’s richest threat intelligence.
- Bring automated prevention with high-fidelity detections – Shutdown attacks based on a chain of behaviors, irrespective of the specific malware or tools utilized, along with cloud-native AI models continuously delivered to the Falcon agent with newly-found IoAs.
- Activate IoAs at cloud scale, trained on human-led expertise – Incorporate insights with AI-powered IoAs from CrowdStrike’s popular threat hunting team to decrease the false positives, maximize analyst productivity and deploy threat hunting at scale.
These AI-powered IoAs have found more than 20 never-seen-before adversary patterns, according to CrowdStrike. The patterns have been validated by experts from the industry and enforced on the Falcon platform for the purpose of automated detection and prevention.
New Innovations for Fileless Attack Prevention at Scale
As per the CrowdStrike Global Threat Report 2022, 62% of all the attacks globally are malware-free. These fileless attacks can be carried out entirely in memory, developing a blindspot for threat actors to exploit. With the Falcon platform, organizations can:
- Avoid the most advanced fileless attacks – All the advanced persistent threats (APT) can be stopped with the advanced memory scanning practices that augment best-of-breed AI/ML and IoA detections with high-speed scanning of all the memory at an unprecedented scale.
- Leave bloated memory scanning behind – Remove the heavy resource constraints of legacy approaches that made memory scanning a non-starter with high-performance memory scanning techniques, optimized for Intel CPU/GPUs.
- Kick-off memory scans on behavior, not fixed schedule – Automate the scans with the behavior-based triggers to find and stop fileless attack patterns in real-time, not after a potential breach.
Enhanced Visibility for Stealthy Cloud Intrusions
Considering that Linux environments, applications and data have moved to the cloud, the adversaries have also migrated to the cloud to open backdoors and steal sensitive information. With the CrowdStrike Falcon platform, the organizations can:
- Hunt stealthy rootkits and reduce dwell time – Find malicious activity quickly in the kill chain with deep Linux kernel visibility to fuel threat hunting and investigation of hidden, emerging Linux attacks.
- Bolster managed cloud threat hunting – Disrupt the most sophisticated threats present in the cloud environment with new kernel telemetry events for Falcon OverWatch experts, building on CrowdStrike’s latest Falcon OverWatch Cloud Threat Hunting service.
