Kaspersky
CompromiseAssessment

What is Kaspersky CompromiseAssessment?
Cybercriminals
attack users
with 400,000 new
malicious files
every single day

Kaspersky Compromise Assessment (CA) uncovers active cyberattacks
as well as previous unknown attacks that flew under the radar of yourIT security tools and processes. The goal is to get the highest possiblelevel of assurance as to whether or not your network is compromised,with independent expert analysis. The service establishes the most
likely reasons for an incident, its source and impact, and recommends
remediation actions.

How CA can help
• Understand your specific threat landscape by analyzing threat
intelligence sources (including darknet)• Reveal possible signs of compromise• Perform tool-aided endpoint scanning of your IT infrastructure• Analyze security event logs and network activity including outgoingconnections to Command and Control servers of malware• Conduct an initial incident investigation to identify malware used forthe attack(s)How Kaspersky Compromise Assessment works
Compromise Assessment consists of the following stages:

Data Collection

Remediation & Reporting

At the Data Collection stage, we'll scan
all your hosts, and collect relevant
forensic metadata and historical logs
to look for footprints of cybercrime.
Our team will analyze multiple threat
intelligence sources to understand yourorganization's specific threat landscape,including APT groups attacking yourindustry and region.

We'll prepare a final report with detailed answers to key questions:Threat Hunting

Incident Validation and Early Response

We'll then process all the data we'vecollected and identify incidents in yournetwork. Some incidents will be 100%
confirmed (e.g. a malware infection).
In these cases, we will immediately
provide response recommendations.
Some incidents may require additional
confirmation and validation (e.g.
suspicious user behavior).

To confirm the more severe incidents, we may need additional data for in-depth analysis,e.g. the compromised system's disk image, or executable binary or script, to see whether
or not it's malicious. For all confirmed incidents we develop actionable threat intelligence toscope the incident and contain the threat.

• Are you compromised? We'll provide you with an executive summary on the presence,or absence, of signs of compromise in your network.
• If you have been compromised — what happened? You'll be able to see a detailed
picture of cyberespionage activity in your network, including discovered incidents,
affected network components, a description of the vulnerabilities used, likely attack
sources, and the results of malware analysis.
• What needs to be done? You will receive recommendations on how to protect yourresources from similar attacks in the future, and how to enhance protection against
the detected security flaws and misconfigurations that have been dealt with.

Kaspersky Compromise Assessment deliverables
The service's findings cover:

12

Conclusions as to whether or not your network is,or has been, compromised

Collected threat intelligence and indicatorsof compromise (IOC)3

4

Details of possible attack sources
and compromised network components

Remediation recommendations to mitigate
the impact of detected incidents

Recommendations on how to protect your resources from similar attacks in the future.

Why Kaspersky
Certified Threat Hunters

Adaptive Tools and Telemetry

Actionable Threat Intelligence

Our team consists of certified experts
in digital forensics, reverse engineering,
malware analysis, and network security

Threats are detected using IoC, TTP,YARA, and Threat Intelligence. We
can easily modify our detection rules,
tools, and telemetry to find new typesof threats

As a global threat intelligence provider,
we have an extensive blacklist database
as well as a huge whitelist database,which helps to identify threats faster

Learn more

www.kaspersky.com© 2023 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture