Microsoft Threat
Detection
ReportTitle Goesand
Here Response:This is the subtitle of the report

Five Key Pitfalls (and How to Address Them)Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Microsoft Threat Detection andResponse: Five Key Pitfalls(and How to Address Them)
Authors
Rafael De Lima
Cyber Security
Solutions Architect

Michael Cowley
Head of Solution
Engineering

Thomas Hind
Vice President
Platform Architecture

Organizations are increasingly turning to the cloud in their attempt to become moreagile and efficient. Many will choose the Microsoft ecosystem and consequently willneed to become familiar with Microsoft Security Products, how these technologies
can be leveraged to their full potential, and what will need to be supplemented to avoid
unnecessary risk. Drawing on Kroll’s experience gained by responding to thousands ofincidents each year, this guide outlines:
Common security challenges organizations face when moving to a Microsoft
cloud environment
Practical steps to help accelerate threat detection and response acrossyour Microsoft estate
How to get the most value from solutions such as Microsoft Sentinel andthe Microsoft XDR solutions, of Microsoft 365 Defender and Microsoft Defenderfor CloudInsights from a real-life case study
How Managed Detection and Response (MDR) services can help get the mostvalue from the Microsoft Security stack and what to consider what evaluating
their experience, approach and technical scope2

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Risk Vs. Opportunity: Threat Detection andResponse in the Microsoft Ecosystem
As the drive to move business operations to the cloud continues at pace, the expanded attack
surface generated by digital transformation continues to present new opportunities for threat
actors—and considerable risks for organizations.
For businesses ambitious to maintain a robust security posture in an ever-evolving threat
landscape, there is a lot to consider technically. Not only must threat detection in the Microsoft
ecosystem leverage native tooling and telemetry but also, at the same time, it must be
supplemented with intelligence-driven detections specific to cloud threats.
Added to this, the rapid and effective detection of a genuine cyber threat is futile without acorresponding rapid and effective response that addresses not only containment but also
remediation and forensic analysis to prevent reinfection. Not having these processes in place
can pose a significant risk to a business. However, by recognizing the potential obstacles andworking with trusted experts, organizations can maximize both their Microsoft investment andlevel up their cybersecurity.

5 Key Microsoft Threat Detection and Response Pitfalls to Avoid
Pitfall 1. | Not Understanding Where to Prioritize with Your E5/
Microsoft Defender License
A common challenge for many organizations is a lack of certainty around which products ofMicrosoft Defender/E5 they should prioritize for threat detection and response. For those thathave the EMS E5 or Microsoft 365 Enterprise plan that could mean deciding which solution theyneed to onboard first out of Microsoft Defender for Office 365, Microsoft Defender for Identity,
Microsoft Defender for Endpoint, Defender for Cloud Apps. That’s not taking into account the
separate licensing structures of Microsoft Sentinel and Defender for Cloud.
Outside of carefully considering the type of license you have, it is important to keep an eye on what
is cost effective. For example, additional data ingestion and storage charges can be created byconsuming too much data. Including extra assets and endpoints to monitor, such as additional
servers, workstations and virtual machines may incur additional licensing charges, while someteams spend too much time configuring sensors.

3Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Of course, every organization faces different threats and has a different risk tolerance. However, in
our experience, if you have invested in Microsoft for your IT estate, you can prioritize aspects of the
security stack that are best value through what Gartner calls a “Security Operations Center (SOC)
triad perspective”: gaining essential visibility of logs, endpoint and network infrastructure telemetry.
Recommendations
Start by gaining a clear understanding of the type of Microsoft license you have. We recommend
making sure you have the solutions listed below and prioritizing them for threat detection andresponse. They offer cost-effective licensing while providing that vital combination of prevention anddetection capabilities in the key environments exploited by threat actors in the early stages of attack:Microsoft Defender for Endpoint (DfE)
A critical solution to detect advanced threats on endpoints such as workstations,virtual machines and servers as well as mobile devices to access network
resources. Microsoft DfE provides great integrations with the wider Defender
suite of solutions, offering visibility over an attack’s common lifecycle andvaluable insight into what is accessed, who it’s accessed by, and from where.

Microsoft Defender for Identity - Azure Active Directory (AD)With the traditional network perimeter now being replaced by the authentication
boundary for your trusted resources, Azure AD enables organizations to leveragea central identity and authentication source across third-party resources andSoftware-as-a Service (SaaS) environments, including those outside of Azure andthe Microsoft ecosystem. Microsoft Defender for Identity provides an identitycentric view of users’ activity and behaviour to highlight malicious activity.

Microsoft Defender for Office 365
Protects you against malicious threats posed by email messages, links (URLs)
and collaboration tools. This acts not only as the secure email gateway in frontof your exchange servers but also provides threat investigation and response
capabilities such as alerting of malicious or suspicious activity affecting youremail or users, identifying malicious IP addresses, resetting passwords orblocking the user account.

4Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

By prioritizing Microsoft Defender solutions that cover endpoint, identity and O365—and putting
them all into Microsoft Sentinel—you will begin pulling in data not only from the underlying Azure
environment but also from third-party cloud sources such as AWS and Google Cloud. Using Sentinelin this way also means that everything is in the same place for dashboarding, rules and Microsoft 365
Defender. An advanced Managed Detection and Response (MDR) for Microsoft service like Kroll
Responder MDR for Microsoft will be able to pull relevant alerts from Microsoft’s Defender products,
whilst leveraging the data within those platforms for detailed investigation and remediation on yourbehalf. The Microsoft Reference Architecture for Security Operations leverages Microsoft
Defender as a detection layer for the relevant areas (cloud workloads, identity, endpoints, etc),
passing alerts onto Microsoft Sentinel. Microsoft Sentinel can then also carry out additionalcorrelation based on those alerts or from traditional log sources.

“

An advanced Managed Detection and Response (MDR) for
Microsoft service like Kroll Responder MDR for Microsoft
will be able to pull relevant alerts from Microsoft’s Defender
products, whilst leveraging the data within those platforms
for detailed investigation and remediation on your behalf.

”

Pitfall 2. | Buying Microsoft Security Solutions
Before Understanding How to Configure Them
Many organizations make the error of committing financially to adopting security solutions
before fully understanding the breadth of time and insight required to optimize them. Failingto ensure that effective configuration is in place, to identify the right telemetry and activity, cancause monitoring to become redundant. The good news is that Microsoft has made it simple tointegrate Microsoft Defender and other E5 security solutions into Microsoft Sentinel. The badnews is that, without proper configuration and implementation of these underlying features,
you won’t gain value from them.

5Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Recommendations
Let’s look at one example of this with Microsoft 365 Defender solutions, for which you need to consider:
Data retention
While data retention can be extended to assist with compliance and threat hunting use
cases, it’s worth noting that telemetry for advanced features in this product is generally notavailable after 30 days. Organizations may therefore need to identify other methods ofhunting this data.
Threat policies
Ensure that relevant policies are
configured for each Defender solution.
Examples include policies for anti-malware,anti-phishing, anti-spam, etc.

Automations (in terms of
notifications or remediation actions)
You will need to enable features such as
Live Response, Automated Investigation
and Auto Remediation.

Permissions and roles

Rules and relevant components

Ensure correct admin roles, permissions andassigned Azure Active Directory groups fortier-based/role-based access to assign andauthorize access to different teams.

These include alerts suppression, indicators
and web content filtering.

An effective MDR service provider can help to integrate these solutions to give you visibility
across the tools in which you’ve already invested, multiplying your return on investment. Ask
your MDR provider to advise on the minimum requirements and standards for specific featuresand policies. A good provider should proactively guide you on which logs, policies and rules will
be needed for each of the solutions you’ve invested in, particularly in deployment. They shouldbe able to work with you to define logs worth ingesting for detections and logs worth ingestingfor compliance or retrospective forensics and threat hunting. These different log categories do
not need to be stored in the same expensive storage as one another—and a pragmatic approach
can be to align storage platforms and performance considerations to query and recall cadences,to ensure that you are optimizing budgets.

“With the move to the cloud showing no sign ofslowing down, it is imperative that organizations fully
understand how best to optimize their investments inboth Microsoft solutions and MDR services to get themost security value.

”

Marc Brawner
Head of Cyber Managed Services, Kroll6

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Pitfall 3. | Not Leveraging Response Automation and Native Integrations
Organizations don’t frequently automate response playbooks with on-premise environments
because of the negative impacts this can have on more legacy technology which also demands
specific on-site forensics. However, as the cloud is both highly accessible and fast-moving,
response should be highly automated.
Recommendations
Explore opportunities to leverage native Microsoft tools such as Azure Logic Apps and Power
Automate to set up automated cloud responses. Also, look at opportunities to build playbooks
that are native in Microsoft Sentinel such as:
Notification playbooks

Blocking playbooks

Triggered when an alert or incident
is created, a notification is sent toa configured destination, such as
Microsoft Teams, Slack or Outlook email.

Triggered when an alert or incident iscreated, they gather entity information
like the account, IP address and host,and block them from further actions.

Change an incident’s severity
Triggered by an incident or alert when attached to an automation rule or analytics rule,the incident severity is changed based on a specific username that is part of the incident
user entity.

When combining Microsoft Sentinel with a Microsoft Defender solution, more comprehensive
playbooks include:

Compromised machine

Activity from infrequent country

An analytics rule indicates a compromised
machine, as discovered by Microsoft
Defender for Endpoint. An incident iscreated in Microsoft Sentinel that includes
related alerts and entities. Use the Entities- Get Hosts action in Microsoft Sentinel
to parse the suspicious machines that areincluded in the incident entities. Issue acommand to Defender for Endpoint toisolate the machines in the alert.

Triggers alerts when activity is detectedfrom a location that was not recently
or was never visited by any user in theorganization. It also uses Power Automate
to contact users detected as connectingfrom infrequent locations, and their
managers, in order to verify their activity.

7

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

It is important to understand the difference between Microsoft Sentinel automations and broader
SOC automations. While Microsoft Sentinel will help automate API integrations with othertechnologies, a broader SOC workflow automation is needed to cover triage, enrichment of threat
intelligence Indicators of Compromise (IOCs) and containment. This should be supplemented withfrontline intelligence and strategic response that uses digital forensics and incident response (DFIR)
techniques such as root-cause analysis, reverse engineering, threat hunting and malware removal.
Example Playbook
In the example playbook below, an attacker aims to access a virtual machine (VM) and starts
scanning the network to get a lay of the land. This triggers an alert, pulling user, device andnetwork information (1). From here, various response actions can be triggered such as tagging theVM as compromised (2) and taking a snapshot of that VM (3). That snapshot can be used to run
point-in-time forensics and, in parallel with the automation of packet capture enabled on the VM,
conduct root-cause analysis as well as ongoing hunting of the deep network activity (4) that theendpoint continues to exhibit.
Suspicious Login to a VM
(either following failed attempts or
through conditional access policies)

VM begins scanning the network

An alert is triggered, pullinginformation from the source events(users, devices, networks, etc)

Playbook tags user
as “Compromised”

Playbook tags VM
as “Compromised”

Playbook thenisolates thetagged VM

Playbook is
triggered creatinga VM Snapshot for
the tagged VMs

Forensic artifact
collection and routecause analysis

8

Playbook is
triggered starting apacket capture forthe tagged VMs

Playbook revokes
AAD sign in sessions

Playbook blocks
AAD accountThreat hunting acrosswider environment

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Pitfall 4. | Not Addressing the Costs and Complexities of Log Ingestion
As organizations start adopting Microsoft Sentinel, they can suddenly find themselves overwhelmed with vastquantities of data collected from an ever-increasing number of new data sources. This can significantly increase thecosts of log storage and ingestion, leaving security teams with the reactive and risky task of reducing theircoverage or having to suppress log collection altogether.
Recommendations
While it’s important to maintain coverage of your estate, you can reduce costs by scrutinizing which logs are essential
for ingestion compared with those that can be archived. To achieve this, we recommend filtering data at ingestion
to archive compliance-related and lower fidelity data into a long-term cloud data lake, such as Azure Data Explorer(ADX), and routing high-fidelity data—specific for threat detection use cases—into Microsoft Sentinel (Log
Analytics). Microsoft Sentinel uses the same query language as ADX, which means you can focus on addressing
high-fidelity alerts in your Security Information and Event Management (SIEM) while continuously hunting acrossyour data lake for related data and generating detailed analytics reports at the same time.
Organizations also need to understand how the different types of logs can benefit their security in the cloud.
While analytic logs provide insights for traditional SIEM correlation, lower value security telemetry can be ingested
as basic logs, which can be used for threat hunting and provide additional context as part of investigations.

“

We recommend filtering data at ingestion to archive
compliance-related and lower fidelity data into a long-term
cloud data lake, such as Azure Data Explorer.

”

Pitfall 5. | Not Harnessing Opportunities Presented by Defender for CloudToo many organizations continue to overlook the many advantages of leveraging Defender for
Cloud for environments such as Azure and AWS, not least its ability to break down into moregranular solutions covering monitoring for SQL, storage, containers, etc. One example of this isclicking “Enable” in Defender for Cloud, which immediately covers you for data points needed
for alerting on all types of threats without any further configuration required, as demonstrated
in the diagram below:

9Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Lateral Movement
Malicious content
uploadMalware distribution

Credential Access

Persistence
Reconnaissance

Firewalls and Virtual
Network conﬁguration
changes

Storage accountdiscovery

StorageThreatMatrix

Public containers
discovery

Accessquery key
Access Cloud
Shell proﬁlesRole-based access
control (RBAC) changes

Use ofpublic access
Valid Azure
Active Directory(Azure AD)
principal
Valid access key
Valid SAS URI

Access control list
(ACL) modiﬁcation

Storageservicediscovery

Automated
exﬁltration
Data transfer
size limits

Discovery

Storage data clone
RBAC changes

Initial Access

Firewalls and Virtual Networks
conﬁguration changes

Triggercross-service
interaction

Data
corruption

Data manipulation

Data encryption
for impact(ransomware)

Access Cloud
Shell proﬁlesACL
modiﬁcation
Automated
exﬁltration
Data transfer
size limits
Storage dataclone

Exﬁltration

Defense Evasion
Source: Ben Mansheim, 2023, Microsoft Defender for Storage Classic

Recommendations
If your organization is looking to move to the cloud or to operate in an Azure or AWS environment,
start connecting Microsoft Defender for Cloud to your servers to benefit from features such as
application control and compliance monitoring. This will also help to protect Platform as a service(PaaS) and cloud-native resources which are traditionally difficult to secure.
In terms of response, your organization should then be able to pivot into Microsoft Sentineland give cloud logs to incident response specialists, enabling them to sift through via a cloudcompromise engagement and providing valuable forensic information for making effective andtimely remediations.

10

ImpactMicrosoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Case Study: Seamless Microsoft Azure Migration
Company: BSM
With ransomware increasing and a complex, business-critical cloud migration on the horizon,
one of the world’s largest shipping companies BSM was seeking a solution to monitor its
environment for potential threats. It was looking to do this by building a long-term partnershipwith an experienced MDR provider. This was particularly important given BSM’s planned
cloud migration to Microsoft Azure, aimed at achieving a more centralized IT approach forboth its primary and smaller offices, many of which were small maritime centers.
BSM recognized that the diverse challenges it was facing could be addressed by working
with Kroll. Kroll’s MDR solution, Kroll Responder, enriches Microsoft’s technology by applying
frontline threat intelligence drawn from thousands of cyber incidents handled every year,
enabling deeper and more effective threat hunting. This is supported by Kroll Responder’sglobal SOC professionals, who operate as a virtual extension of the team, providing thehigh-quality insight and mitigation guidance that BSM’s IT team needs to respond to incidents
whenever they arise. To further ensure that BSM’s security is as robust as possible, Kroll also
conducts managed vulnerability scanning and CREST-accredited penetration testing to help
identify and address vulnerabilities across its global infrastructure.
BSM was able to successfully migrate from a legacy security information and event
management (SIEM) solution to cloud-native security monitoring with Microsoft Sentinel.
This was achieved through Kroll’s technology-agnostic approach and deep integration with
Microsoft. BSM’s IT team is now able to swiftly identify threats and gain the help it needs to
respond when threats arise, from phishing attempts that are prevented in collaboration with
the Secure Email Gateway (SEG) vendor to stopping fully-fledged ransomware attacks before
detonation. The company also has greater visibility across its global network of offices andships to better detect and respond to threats. Teams within Kroll help BSM to navigate anddeploy appropriate security controls and processes, including those related to its Microsoft
Security strategy.
By working closely with Kroll and drawing on its close links with Microsoft, BSM is now better
prepared for the future evolution of the security market and threat landscape.

View more customer stories at the Kroll Case Study Hub.

11

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Alleviating the Challenges of Cloud Threat Detection and Response:
What to Look for in an MDR for Microsoft provider
Organizations often start by adopting Microsoft Security products but struggle to stay on top of the
fast-moving changes in their portfolio. Yet another challenge is gaining access to the right team ofexperts and processes to achieve the best from these products and their capabilities. Effective MDR
services can deliver the talent, processes and expertise to ensure your organization gains the greatest
value from solutions such as Microsoft Sentinel, Microsoft 365 Defender and Microsoft Defender for
Cloud. However, not all Microsoft MDR providers are capable of delivering the caliber of experienceand insight required to address the potential pitfalls. To avoid the risks, assess potential MDR
providers on the basis of the criteria outlined below:
Microsoft-certified security specialists
Look for a provider whose services are delivered by security experts certified in
Microsoft Security competencies such as AZ-500 Microsoft Azure Security Technologies(security engineers capable of implementing, managing and monitoring security
for resources in Azure, multi-cloud and hybrid environments as part of an end-toend infrastructure) and SC-200: Microsoft Security Operations Analyst (security
analysts certified in investigating, responding to and hunting for threats using
Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender andthird-party security products).
Microsoft Commercial Marketplace
Check that your prospective provider is in the Microsoft Commercial Marketplace
containing the ‘Get it Now’ button in their offering overview page. This makes it
easier for existing Microsoft businesses to select and onboard MDR service
providers using their existing enterprise plans.
Field-proven experience
Aim to identify an MDR provider with a proven track record of investigating Microsoftrelated security incidents of all sizes, types and complexity. This ensures that, as well as
being able to demonstrate relevant experience, they will have the threat intelligenceand detection rules needed to detect these threats. A good first point of call is to look at
providers who carry the Microsoft Gold Partner, Microsoft Security Solutions Provider
or the Microsoft Intelligent Security Association badge. This demonstrates their highstandard of expertise and investment in Microsoft Security.
Continual engagement with Microsoft
Verify whether your potential provider is actively engaged with Microsoft on acontinual basis. This level of insight will ensure that they can track the trajectorythat Microsoft is developing with certain products, enabling them to plan for andmake the most of new capabilities as they become available.
12Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Response beyond containment
While MDR has become an effective approach to addressing the security skills gaps
around detection and response, organizations have been disappointed withthe “response” provided by most MDR vendors. This is because it often stops atcontainment, putting the onus on the client to remediate and investigate. Some
providers may even help eradicate a threat but, due to the lack of a complete response,
they leave the door open to reinfection.
More traditional MDR providers will rely on your technology stack to carry out effective
response. For example, their response capabilities would be limited to what your
EDR tool can achieve. Although this is of course important, having dedicated incident
response teams involved would enable you to go beyond the capabilities of your EDR.
Rather than leaving your organization hanging, response should cover the wholeincident response lifecycle and enable continuous improvement. This means closing the
gap between merely containing the threat to actively removing it across all affected
systems and quickly understanding the root cause, so that it doesn’t happen again.
Ongoing insight
Ensure that your potential MDR provider can deliver ongoing insight into the latest
threats that may impact your business, while also turning this intelligence into active
detection, hunting and response efforts. Threat intelligence needs to be as wideranging as it is deep; wide enough to include a variety of organic, open-source andproprietary sources, yet deep enough to identify not just known attacker indicatorssuch as an IP address, internet domain or file hash—referred to as IOCs—but also
actual methods and behaviors used by attackers—known as tactics, techniques andprotocols (TTPs). This kind of intelligence requires access to dark web forums, live
incident response and forensic analysis, and exposure to both cybercriminal andnation-state level activity.
An adversary-driven mindset
It is critical to check that your potential MDR provider has an offensive perspective or
teams beyond its core SOC that engage with live attacker campaigns and use thisinformation to frequently update detections. This requires tight integration between
threat intelligence analysts, malware analysts and detection engineers.

The advantages of working with an effective MDR for Microsoft partner
Greater ROI on native endpointand cloud technology

Enriched telemetry
Frontline threat intelligence

Enhanced threat visibility
Faster detection, more effective response13Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Maximizing Your Microsoft
Security Investment:
Key Takeaways
In the rush to benefit from Microsoft Security tools, organizations are putting themselves at risk
by failing to fully understand the scope of technology they are adopting. This isn’t surprising, considering
the many issues they need to consider. When assessing or planning your own use of Microsoft security
technologies, stay vigilant about falling into common traps that affect many organizations. These range
from a lack of uncertainty around which features of your license to start with, not leveraging automationand native integrations, and failing to addressing the costs and complexities of log ingestion.
Working with a good MDR provider plays a key role in not only enabling companies to address thepotential pitfalls but also significantly enhancing the impact of their Microsoft Security products.
In assessing the best MDR provider for your requirements, it is important to assess potential vendors
against key criteria, such as a proven track record of investigating Microsoft-related security incidents
of all sizes, types and complexity, the scope to go beyond containment, and an offensive perspective.
The rewards of Microsoft Security tools are significant but without an effective MDR provider on the side,
the potential risks are too high to ignore. That’s why, at Kroll, we enable organizations to unlock the fullpower of their Microsoft security stack with Kroll Responder, our MDR solution. Kroll Responder MDR for
Microsoft provides 24/7 visibility of threats and complete response across your network, endpoint, cloudand email environments, allowing you to maximize your entire Microsoft security technology investment.

Responder
Managed XDR
for Microsoft

Responder MDR
for Defenderfor Endpoint

Responder
MDR forSentinelGet a custom demo of Responder MDR for Microsoft

14

Responder
MDR forOffice 365

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

Microsoft and Kroll
The Perfect Partnership
Microsoft Defender

Telemetry from Microsoft as well as
third-party security tools gets enrichedwith frontline threat intel fromMicrosoft Sentinel

3,000+ cyber incidents
handled by our team every year.

This unified telemetry helps deliver
enhanced visibility, and at the handsof our seasoned IR pros, enables

threat hunting, containment,
eradication, and remediation.

$1M INCIDENTPROTECTIONWARRANTYTheT
h entire service is covered by a complimentary$1$ million Incident Protection Warranty, not dependent
on specific hardware or software choices, which includes
ransomware, business email compromise, and otherpotential issues.

15

Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)END-TO-END SOLUTIONS TO
STOP CYBERATTACKS NOWManagedDetection &Response

ThreatIntelligence

Rafael De Lima

THREAT
LIFECYCLE
MANAGEMENT

SPOND
RE

OffSec &AppSec

OTECT
PR

DETECT
Incident
Response

Michael Cowley

Thomas Hind

Additional hotlines at:

Cyber Security

Head of Solution Engineering

Vice President

kroll.com/hotlines

Solutions Architectmichael.cowley@kroll.com

Platform Architecture

rafael.delima@kroll.com+44 7827251673

thomas.hind@kroll.com

Or via email:+44 7824606854

CyberResponse@kroll.com+44 2045069771

About KrollAs the leading independent provider of risk and financial advisory solutions, Kroll leverages our unique insights, data and technology to help clients stay ahead of complex
demands. Kroll’s global team continues the firm’s nearly 100-year history of trusted expertise spanning risk, governance, transactions and valuation. Our advanced solutions
and intelligence provide clients the foresight they need to create an enduring competitive advantage. At Kroll, our values define who we are and how we partner with clientsand communities. Learn more at Kroll.com.
M&A advisory, capital raising and secondary market advisory services in the United States are provided by Kroll Securities, LLC (member FINRA/SIPC). M&A advisory, capitalraising and secondary market advisory services in the United Kingdom are provided by Kroll Securities Ltd., which is authorized and regulated by the Financial Conduct Authority(FCA). Valuation Advisory Services in India are provided by Kroll Advisory Private Limited (formerly, Duff & Phelps India Private Limited), under a category 1 merchant banker
license issued by the Securities and Exchange Board of India.
© 2023 Kroll, LLC. All rights reserved. KR23040682