December 12, 2024

The Bite from Inside: The Sophos Active Adversary Report

A sea change in available data fuels fresh insights from the first half of 2024

Security OperationsThreat Research

December 11, 2024

December Patch Tuesday arrives bearing 71 gifts

Seventeen Critical-severity CVEs ready to deck your halls; also, new blog guidance for Windows Server admins

Threat Research

June 12, 2024

RD Web Access abuse: Fighting back

Investigation insights and recommendations from a recent welter of incident-response cases

Security OperationsThreat Research

April 03, 2024

It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024

The latter half of 2023 found numerous fronts on which attackers failed to press ahead. Are defenders failing to take advantage?

Threat Research

March 20, 2024

Remote Desktop Protocol: The Series

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Security OperationsThreat Research

March 20, 2024

Remote Desktop Protocol: Exposed RDP (is dangerous)

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data answers, loud and clear

Security Operations

March 20, 2024

Remote Desktop Protocol: Queries for Investigation

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits

Security Operations

March 20, 2024

Remote Desktop Protocol: How to Use Time Zone Bias

Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs

Security Operations

March 20, 2024

Remote Desktop Protocol: Executing the 4624_4625 Login Query

Keeping an eye on who’s trying to get onto your network – whether or not they’re successful – can pay off on multiple fronts

Security Operations