Darknet Parliament(KILLNET,ANONYMOUS SUDAN,REVil) Tries to Paralyze the West's Financial System

Indicators of Compromise

APT Groups

Notes

<div><b>CONCLUSION</b></div><div><span style="background-color: transparent; color: rgb(66, 66, 102); font-weight: 700; letter-spacing: -0.00833em;">How to Use SOCRadar for Detecting Ransomware Attacks Early?</span></div><div><span id="docs-internal-guid-7e202872-7fff-3794-e2c9-cc159700f7c6"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38; padding: 0pt 0pt 18pt;"><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">The cyber threat intelligence campaign strategic tactical operational service offered as SOCRadar Unified protects from ransomware attacks with the following items.</span></p><p style="margin-top: 0pt; margin-bottom: 18pt; line-height: 1.38;"><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">&nbsp;SOCRadar Attackmapper module prevents and quickly&nbsp;</span><a href="https://socradar.io/suites/attack-surface-management/critical-port-detection/"><span style="color: rgb(255, 84, 98); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">detects ransomware</span></a><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">&nbsp;attacks by discovering and tracking your assets on the Internet:</span></p><ul style="margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Making an inventory of digital assets open to the Internet,</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Critical port notification,</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 21pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">0-Day vulnerability detection,</span></p></li></ul><p style="margin-top: 0pt; margin-bottom: 18pt; line-height: 1.38;"><a href="https://socradar.io/suites/digital-risk-protection/"><span style="color: rgb(255, 84, 98); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">SOCRadar RiskPrime Module</span></a><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">&nbsp;provides the detection of intelligence information about your assets and your company:</span></p><ul style="margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Creating alarms in possible situations by automatically tracking company domains in Dark and Deep web environments</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">The HUMINT ability of SOCRadar dark web analysts allows your company to communicate with the threat actor to confirm the accuracy of up-to-date information and remove postings to increase the company’s reputation when necessary.</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 21pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Creating alarms in possible situations by automatically following the 3rd party companies providing services to your company in Dark and Deep web environments</span></p></li></ul><p style="margin-top: 0pt; margin-bottom: 18pt; line-height: 1.38;"><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">&nbsp;</span><a href="https://socradar.io/suites/cyber-threat-intelligence/"><span style="color: rgb(255, 84, 98); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">SOCRadar ThreatFusion Module</span></a><span style="color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">&nbsp;provides to detect intelligence on current cyber events:</span></p><ul style="margin-top: 0px; margin-bottom: 0px;"><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Vulnerability Tracking with internal/external systems and applications for vulnerabilities notifications,</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Integration of IOCs used by threat actors into security devices,&nbsp;</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Integration to detect and block phishing domains used by ransomware groups for phishing purposes,</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">With the help of country-based and sector-based detections for ransomware attacks, sending threat-sharing notifications to companies that may be affected by these attacks can enable them to take action.</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Active monitoring of threat actors,</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Threat sharing about ransomware attacks actively informs security personnel.</span></p></li><li style="list-style-type: disc; color: rgb(96, 96, 128); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline; white-space: pre;"><p role="presentation" style="margin-top: 0pt; margin-bottom: 21pt; line-height: 1.38;"><span style="background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">We are analyzing suspicious files with the Threat Analysis module.</span></p></li></ul></span></div>

Mitigation

<div style=""><b style=""><font>Denial of Service (DoS)</font></b></div><div>Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment.</div><div><br></div><div>Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. <br></div><div><br></div><div>Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition.</div><div><br></div><div>Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through Remote System Information Discovery. There are examples of adversaries remotely causing a Device Restart/Shutdown by exploiting a vulnerability that induces uncontrolled resource consumption. <br></div><div><br></div><div><div><b><font>Procedure Examples</font></b></div><br><div style="font-size: small;"><b>S0093 - Backdoor.Oldrea</b></div><div style="font-size: small;">The Backdoor.Oldrea payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications. <br></div><div style="font-size: small;"><br></div><div style="font-size: small;"><b>S0604 - Industroyer</b></div><div style="font-size: small;">The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually. [5] Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E. [5]</div><div style="font-size: small;"><br></div><div style="font-size: small;"><b>S1006 - PLC-Blaster</b></div><div style="font-size: small;">The execution on the PLC can be stopped by violating the cycle time limit. The PLC-Blaster implements an endless loop triggering an error condition within the PLC with the impact of a DoS. <br></div><div style="font-size: small;"><br></div><div><div><b><font>Mitigations</font></b></div><br><div style=""><b style="background-color: transparent; color: rgb(57, 67, 76); letter-spacing: -0.00833em;"><font>Detection</font></b><br></div><div><span id="docs-internal-guid-5d63c3b4-7fff-3fb9-03fa-c5dd31e88e32"><div style="font-size: small; margin-left: 0pt;" align="left"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38; text-align: center;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ID</span></p></td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38; text-align: center;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Data Source</span></p></td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38; text-align: center;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Data Component</span></p></td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38; text-align: center;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Detects</span></p></td></tr><tr style="height: 57pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0015"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">DS0015</span></a></p></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0015"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Application Log</span></a></p></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0015/#Application%20Log%20Content"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Application Log Content</span></a></p></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Monitor for application logging, messaging, and/or other artifacts that may result from Denial of Service (DoS) attacks which degrade or block the availability of services to users. In addition to network level detections, endpoint logging and instrumentation can be useful for detection.</span></p></td></tr><tr style="height: 83.25pt;"><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-top: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0029"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">DS0029</span></a></p></td><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-top: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0029"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Network Traffic</span></a></p></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Network Traffic Content</span></a></p></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).</span></p></td></tr><tr style="height: 42.75pt;"><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-bottom: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><br></td><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-bottom: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><br></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Flow"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Network Traffic Flow</span></a></p></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.</span></p></td></tr><tr style="height: 56.25pt;"><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-top: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0040"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">DS0040</span></a></p></td><td style="border-left: 0.75pt solid rgb(223, 223, 223); border-right: 0.75pt solid rgb(223, 223, 223); border-top: 0.75pt solid rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0040"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Operational Databases</span></a></p></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><a href="https://attack.mitre.org/datasources/DS0040/#Process%20History/Live%20Data"><span style="color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Process History/Live Data</span></a></p></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><p style="margin-top: 0pt; margin-bottom: 0pt; line-height: 1.38;"><span style="color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Monitor operational data for indicators of temporary data loss which may indicate a Denial of Service. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections.</span></p></td></tr></tbody></table><br></div><div style="margin-left: 0pt;" align="left"><div style="margin-left: 0pt;" align="left"><b><font>How to Mitigate&nbsp;</font></b></div><div style="margin-left: 0pt;" align="left">A layered and hybrid approach can help you mitigate DDoS attacks. Following is a list of technologies and providers to leverage to keep your internet-facing systems accessible and avoid business interruptions.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">Internet Service Providers (ISPs): ISPs limit the network bandwidth of your servers to stop DDoS attacks. If a large amount of traffic is detected, ISPs block all incoming traffic quickly. Even though the server is unreachable during the attack, there is no aftermath of the attack because the DDoS attack never actually happened.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">Content Delivery Networks (CDNs): Content delivery networks are networks of servers scattered worldwide aiming to distribute the load off an original server. CDNs can handle high volumes of traffic and help companies mitigate DDoS attacks.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">Web Application Firewalls (WAFs): Web application firewalls filter and monitor HTTP requests of a server, and they provide effective mitigations against Application layer (Layer 7) attacks.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">Cloud Scrubbing Centers (CSCs): Cloud scrubbing centers operate in the external layer, and they are responsible for filtering and cleansing the incoming traffic before it reaches the target server.</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">On-premises appliances: On-premises appliance solutions offer advanced protection against DDoS attacks designed to bypass security solutions operating in the external layer.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">DNS protection: DNS protection solutions also filter and monitor incoming queries and detect malicious DDoS packets to protect servers from DDoS attacks.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">Native cloud providers: Native cloud providers offer cloud-based servers with high traffic handling capabilities and accelerated traffic features. Popular cloud providers such as Cloudflare state that cloud providers provide effective solutions against DDoS attacks.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">These technologies can be categorized into three layers:&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">The external layer consists of cloud scrubbing centers, content delivery networks, DNS protection solutions, and Internet service provider services. The external layer is responsible for handling, monitoring, and filtering the incoming traffic before it reaches the main servers.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">The perimeter layer is specific to on-premises solutions. The security solutions in this layer provide extensive protection against DDoS attacks able to circumvent the external layer of your network.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><div style="margin-left: 0pt;" align="left">The internal layer consists of WAFs inside your network. It offers protection against application layer (Layer 7) attacks by filtering HTTP GET/POST requests aiming to exploit specific components of your servers.&nbsp;</div><div style="margin-left: 0pt;" align="left"><br></div><br><div style="margin-left: 0pt;" align="left"><span id="docs-internal-guid-5d63c3b4-7fff-3fb9-03fa-c5dd31e88e32"><b><a href="https://socradar.io/labs/dos_resilience/">SOCRadar</a> </b></span><b><font><a href="https://">DoS Resilience Check<br></a></font></b></div><div><br></div></div></span></div></div><div><br></div></div><div style="font-size: x-large; font-weight: bold;"><br></div>