March 20, 2024

Remote Desktop Protocol: The Series

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Security OperationsThreat Research

March 20, 2024

Remote Desktop Protocol: Exposed RDP (is dangerous)

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data answers, loud and clear

Security Operations

March 20, 2024

Remote Desktop Protocol: Queries for Investigation

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits

Security Operations

March 20, 2024

Remote Desktop Protocol: How to Use Time Zone Bias

Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs

Security Operations

March 20, 2024

Remote Desktop Protocol: Executing the 4624_4625 Login Query

Keeping an eye on who’s trying to get onto your network – whether or not they’re successful – can pay off on multiple fronts

Security Operations

March 20, 2024

Remote Desktop Protocol: Executing the External RDP Query

On the hunt for successful RDP connections that have entered your network from outside? A step-by-step guide (and a query to get you started)

Security Operations

March 19, 2024

Sophos named a Leader in Frost & Sullivan’s 2024 Frost Radar™ for Global Managed Detection and Response

Sophos has been named a Leader by Frost & Sullivan for Managed Detection and Response

Products & Services

March 13, 2024

Sophos named a Leader in the 2024 IDC MarketScape for Worldwide Modern Endpoint Security for Small Businesses

This IDC MarketScape evaluates how their endpoint security vendors meet the needs of organizations with fewer than 100 employees.

Products & Services

February 23, 2024

ConnectWise ScreenConnect attacks deliver malware

Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments

Threat Research