|
Targeted attack: experience from the trenches |
|
|
|
Source: Sans.org - Posted by Benjamin D. Thomas
|
Learning lessons from incidents is a very important part of incident handling. Yet with targeted attacks it is very hard as you need to have a case before you can learn. So learning from others is even more important in this case.
Michael reported on an unnamed organization being hit by a limited, targeted attack.
Detection is mostly the very hard part in these attacks. This case seems to have been detected by a very alert user detecting a domainname in an email that wasn't completely right.
That user detected an email coming in that originated from a domain that looked like their own, but wasn't their own (actually only had an MX record in it). The email was written to look like an internal email, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software.
Read this full article at Sans.org
Powered by AkoComment! |
