Dragos and CrowdStrike issued a joint press release announcing a partnership developed over the past year, combining CrowdStrike's enterprise network experience with Dragos's industrial control systems expertise. The two companies' teams will jointly...
Dragos opens a threat-hunting series by noting that only four ICS-tailored malware cases have been deployed against targets: STUXNET, HAVEX, BLACKENERGY 2, and CRASHOVERRIDE, tied to campaigns including Dragonfly and Sandworm. The post names two...
Dragos outlines how ICS threat hunters can use the Purdue Model's five levels - level four business logistics, level three manufacturing operations, level two control systems, level one intelligent devices, and level zero physical process - to divide an...
The second post in a Dragos threat-hunting series moves from hardcoded Nmap URI indicators to behavioral detection in Bro IDS HTTP logs, using a 2015 4SICS conference geek lounge packet capture covering five hours. The author shows that removing the...
A Dragos blog post traces SMB's role in the 2017 WannaCry, Petya and Bad Rabbit attacks back to ETERNALBLUE, an Equation Group tool leaked by the ShadowBrokers on April 14, 2017, which exploited Windows machines running SMBv1. The post then demonstrates...
Dragos is releasing downloadable "content packs" for its Dragos Platform that codify its intelligence team's and Threat Operations Center's knowledge into threat behavior analytics and investigation playbooks, with the first pack due in the coming weeks....
Dragos describes a shift in OT defense from indicator-of-compromise (IOC) approaches, which are backward-looking and target-specific, to threat behavioral analytics built on adversary tactics, techniques, and procedures. It illustrates this with activity...
Dragos published the fourth part of its Python threat-hunting series, focused on the Tabular Data Stream (TDS) protocol that carries SQL queries and remote procedure calls to and from Microsoft SQL Server, which backs historians such as GE Proficy/iFix,...
Dragos describes how its Platform attaches step-by-step investigation playbooks to threat behavior analytics, so an analyst facing an alert - such as a suspicious executable moved from IT to an ICS engineering workstation at 2 AM - can gather data, triage,...
Dragos describes query focused datasets (QFDs) as pared-down datasets that combine disparate data so analysts can prove or disprove a hypothesis quickly, and says the Dragos Platform ships default QFDs tied to the threat behavior analytics in its content...
Dragos describes third-party compromise as an attack vector that bypasses a company's usual firewall, proxy, and email defenses by exploiting implicit trust between organizations and their suppliers, integrators, and contractors. It cites the M.E.Doc...
A Dragos blog post by Joe Slowik responds to criticism that his public reporting on the XENOTIME activity group and TRISIS malware omitted indicators of compromise. He argues that for operations personnel, sample hashes are effectively useless, and that...
A Dragos blog post argues that the common belief the adversary always holds the advantage in cyber intrusions is an illusion, because the attacker must evade every layer of defense while the defender needs only one detection to trigger a response. The post...
Dragos analyzed TRISIS, malware that infects Triconex safety controllers running firmware V10.2 and V10.4 without modification and likely works across the 10.0 to 10.4 range, delivering its payload over the unauthenticated, UDP-based TriStation 1131...
Dragos states that media reports claiming state-backed hackers have infiltrated the US electric grid and could cause widespread blackouts are false, tracing the coverage to a July DHS presentation on Russian activity that contained previously reported...
Dragos announced its experts will speak and present at 16 conferences over the coming months, and pointed readers to a newly published team page listing staff experience and interests. The post names its first listed event: CEO Robert M. Lee and Principal...
Dragos argues that asset hardware and software inventories alone do not meet the needs of incident responders and security operations staff investigating adversary activity in industrial environments. The company recommends organizations build an...
Dragos published a reading list, curated by its instructors and organized by class module, for students of its 5-day Industrial Control Systems security training class after a student named Marcus suggested it. The list covers books, papers, videos and...
A Dragos blog post argues that the military concepts of strategy, tactics, and logistics translate well to cybersecurity programs, and that deficiencies in any one area produce recognizable, recurring failures. It describes strategy as the executive-level...
Dragos took part in the S4x19 ICS Detection Challenge, which used 400 GB of packet captures from a real-world mining operation with adversaries injected by S4 organizers and no baseline, but the contest itself was cancelled for lack of participants and...
Dragos explains that threat activity groups are analytic constructs built by clustering intrusion events that share features such as IP addresses, domains, or file hashes, first defined in the Diamond Model of Intrusion Analysis. The company says it names...
Dragos describes a gap in cyber threat intelligence between raw indicator-of-compromise feeds, which lack context and cause false positives, and finished intelligence reports, which arrive after analysis and production are complete. The post argues...
At S4x19 in Miami, a Dragos presenter examined the current and potential future state of programmable logic controller virtualization, defining it as software that looks and behaves like specific hardware. The article notes that DCS vendors already deploy...
Dragos argues that offensive ICS operations are not the simple "bad guy gets in, lights go off" scenario many assume, but complex efforts taking years, money, research, and usually several teams or individuals. The company separates access operations,...
Dragos traces how ransomware has reached ICS environments in waves: wormable malware like WannaCry, NotPetya, and BadRabbit spread from IT networks via the MS17-010 SMBv1 exploit or captured credentials, followed by more deliberate attacks such as Ryuk in...
Dragos attended PI World, OSIsoft's annual PI System conference, from April 8 to 12, 2019, where Dan Gunter, a Dragos Principal Threat Analyst, presented with Mark Johnson-Barbier of Salt River Project on using operations data for cyber threat detection...
A Dragos blog post argues that OT/ICS security operations require their own people, process, and technology because industrial environments carry a unique mission, unique risks, and unique cyber threats, even as IT and OT converge technically. The author,...
Microsoft released a security advisory on May 14 for CVE-2019-0708, a Remote Desktop Services vulnerability it says could enable wormable malware similar to WannaCry, which previously hit ICS entities including automotive manufacturers, rail service...
Dragos identified that XENOTIME, the group behind the 2017 TRISIS attack on a Saudi Arabian oil and gas facility, expanded its targeting beyond oil and gas to electric utilities, probing US and Asia-Pacific utility networks starting in late 2018 using...
Tavis Ormandy disclosed a denial-of-service vulnerability in the SymCrypt library, affecting the function SymCryptFdefModInvGeneric in bcryptprimitives.dll, which enters an infinite loop on malformed input and hangs applications such as certutil.exe,...