AlphaSOC

Our technology reveals unknown threats hidden within your cloud, application, network, and endpoint logs.

[AlphaSOC @alphasoc]

Microsoft reports Miasma trojanized 32 @redhat-cloud-services npm packages to steal GitHub, cloud, and CI/CD credentials via preinstall hooks. AlphaSOC flags these malware and C2 patterns to protect customers. Read more here >> https://t.co/WEsCsbk5Ie

[AlphaSOC @alphasoc]

Got CrowdStrike Falcon? Process your raw FDR telemetry with AlphaSOC to deploy your own custom Sigma rules and supercharge your threat hunting. Read more here >> https://t.co/u2hDcbqcl5

[AlphaSOC @alphasoc]

Our engine highlights threats across GitHub and the other applications that your business relies on (e.g., 1Password, Jira, Okta, and Slack). AlphaSOC is free to evaluate for 30 days without restriction or obligation. Learn more here >> https://t.co/JMS064OAaC

[AlphaSOC @alphasoc]

Download the AlphaSOC MITRE ATT&CK Navigator layer and explore the tactics and techniques covered by our in-built managed detections. Read more here >> https://t.co/DPC7Bq13uY

[AlphaSOC @alphasoc]

Interested to know what we've been working on lately? Check out our Changelog that describes the new product features and improvements >> https://t.co/37kpcv43pM

[AlphaSOC @alphasoc]

Microsoft reports a cryptojacking campaign abusing poisoned search results, ScreenConnect, and .NET utilities to deploy GPU miners. AlphaSOC flags these cryptomining and C2 patterns to protect customers. Read more here >> https://t.co/zYlHBR5Wn7

[AlphaSOC @alphasoc]

We process network telemetry to cover 70+ out-of-the-box detection use cases and highlight patterns including spear phishing, impersonation attacks, anonymizing circuit traffic (e.g. Tor and I2P) and cryptomining pool participation. Read more >> https://t.co/Eqck1JlwAS

[AlphaSOC @alphasoc]

We track the most dangerous effective top-level domains (eTLDs) online by processing the indicators within our platform each month. Our feed is updated daily, and you can use it to instantly block traffic to statistically bad domains >> https://t.co/fPxzR5AlLt

[AlphaSOC @alphasoc]

Our open source Network Flight Simulator (flightsim) utility can synthesize many malicious traffic patterns, including DGA, DNS tunneling, ICMP tunneling, and SSH exfiltration. Read more >> https://t.co/2tEPHsrbxp

[AlphaSOC @alphasoc]

Sending audit logs and telemetry to Cribl Stream? You can process those raw events using AlphaSOC via our native integration for Cribl and forward the findings in OCSF format on to your SIEM or Data Lake to reduce your costs. Read more here >> https://t.co/wWGkqxkHoE

[AlphaSOC @alphasoc]

Unit 42 reports TamperedChef clusters delivering malware through trojanized software installers used to compromise victims. AlphaSOC flags these malware and C2 patterns to protect customers. Read more here >> https://t.co/je9YxoEM87

[AlphaSOC @alphasoc]

Using Sigma rules for detection and hunting? Process your EDR telemetry (e.g., Defender for Endpoint, CrowdStrike Falcon, and SentinelOne) with AlphaSOC and deploy both community and custom Sigma detections outside of your SIEM. Read more here >> https://t.co/eIRQKwPVZo

[AlphaSOC @alphasoc]

Want to flag anomalies within your AWS environment and overlay them with MITRE ATT&CK? We have extended our analytics engine to process CloudTrail logs and highlight 400+ threats. Here's a full list of detection use cases >> https://t.co/Eqck1JlwAS

[AlphaSOC @alphasoc]

Need unparalleled visibility into your Azure environment and cloud workloads? AlphaSOC highlights privilege escalation, compromised workloads, hacked accounts, and data exfiltration. Evaluate our analytics engine for free >> https://t.co/I8peIONDkt

[AlphaSOC @alphasoc]

Our Analytics Engine supports detections across endpoints, cloud workloads, and SaaS applications! Process your CrowdStrike FDR telemetry and logs from AWS, GitHub, Slack, Okta, and other platforms to hunt threats. Dig into the docs here >> https://t.co/bYYw6pzgRe

[AlphaSOC @alphasoc]

The DFIR Report details EtherRAT and TukTuk C2 activity ending in Gentleman ransomware deployment across compromised systems. AlphaSOC flags these ransomware and C2 patterns to protect customers. Read more here >> https://t.co/kDOFeroShz

[AlphaSOC @alphasoc]

Want to measure the efficacy of your threat detection stack with regard to cryptomining traffic? Use flightsim to generate Stratum traffic to known mining pool services online >> https://t.co/2tEPHsrbxp

[AlphaSOC @alphasoc]

Got Splunk? Our latest release adds MITRE ATT&CK mapping and enables teams to identify both known and unknown emerging threats. Use Network Behavior Analytics for Splunk to instantly process your network telemetry and solve 70+ detection use cases >> https://t.co/qnAgOMGVZr

[AlphaSOC @alphasoc]

Third-party VPNs are increasingly used by threat actors to exfiltrate data and evade controls. AlphaSOC provides defenders with visibility into these encrypted sessions, as shown >>

[AlphaSOC @alphasoc]

Lookalike domains (aka homoglyphs) are commonly used by threat actors in spearphishing campaigns. AlphaSOC flags these patterns in real-time to alert security teams and protect customers.