Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Use Cases (UEBA)

Stay up to date with the latest & greatest

  • 3 Topics
  • 9 Replies
3 Topics
H
Henrik MartinssonNew Participant
asked in Use Cases (UEBA)
Unable to hunt down the user/process that failes to authenticate on DC

I monitor for failed authentications on DC’s.labels: Authentication | Fail | Kerberos | UserMy top failed authentications is on one client/one account that I can’t hunt down. I have looked at all process’es and their “credential’s” + installed sysmon on the client. But I can’t find the process or user. Any ideas how I could hunt this down?

1438
H
1 year ago
A
Anonymous
posted in Use Cases (UEBA)
Hunting and remediating BlackCat ransomware

Known by many names, including ALPHV, AlphaV, ALPHVM, and Noberus, BlackCat ransomware made headlines for its successive attacks on high-profile targets. Like Black Basta and Lockbit, it also operates under the Ransomware-as-a-Service (RaaS) model and uses double and sometimes triple extortion techniques.BlackCat uses its public leak site to intimidate victims, where anyone can search and access the leaked victim information easily. The highest ransom they have demanded so far is $14 million and it’s speculated that it has similarities with ransomware families like Darkside, Blackmatter, and REvil in regard to the tools, filenames, and techniques they use. To read more about means of protecting your organisation against Black Cat, read our blog on the link below.https://www.logpoint.com/en/blog/hunting-and-remediating-blackcat-ransomware/#detecting-blackcat

360
A
2 years ago
Friedrich von Jagwitz
LogPoint Team
Friedrich von JagwitzLogPoint Team
asked in Use Cases (UEBA)
UEBA Risk Score

LogPoint UEBA: User Risk Score How are the User Risk Scores being calculated (“weighted totals”, “fuzzy logic”, ...)?

971
Nils Krumey
LogPoint Team
3 years ago
Terms & ConditionsCookie settings