Kaspersky
ThreatHunting

Security teams across all industries are working hard building systems to provide comprehensive protection
against rapidly evolving cyber threats. But most of these take an “alert” driven approach to cybersecurity
incidents, reacting only after an incident has already taken place.
According to recent research, a large proportion of security incidents still goes undetected. These threats
move in under the radar, giving businesses, quite literally, a false sense of security. As a result, organizations
are increasingly recognizing the need to proactively hunt out threats that are lying undiscovered but still
active within their infrastructures. Kaspersky Threat Hunting Services help to uncover advanced threatshiding within the organization, using proactive threat hunting techniques carried out by highly qualified andexperienced security professionals.
Kaspersky
Cybersecurity Services
Kaspersky
Threat Intelligence

Kaspersky
Threat Hunting
Kaspersky Managed Protection
Targeted Attack Discovery

Kaspersky
Security Training

Kaspersky
Incident Response

Kaspersky
Security Assessment

Service benefits• Fast, efficient detection, enabling faster andmore effective mitigation and remediation.
• No time-wasting false positives, thanks
to the clear, immediate identification andclassification of any suspicious activity.
• Reduced overall security costs. No needto employ and train a range of different
in-house specialists you may need.
• The reassurance of knowing that you
are continuously protected against eventhe most complex and innovative nonmalware threats.
• Insights into attackers, their motivation,
their methods and tools, and thepotential damage they could inflict,supporting the development of your fully
informed, e­ective protection strategy.

Kaspersky Managed Protection
The Kaspersky Managed Protection service offers Kaspersky Endpoint Security andKaspersky Anti Targeted Attack Platform users a fully managed service, deploying aunique range of advanced technical measures to detect and prevent targeted attacks
on your organization. The service includes round-the-clock monitoring by Kaspersky
experts and the continuous analysis of cyberthreat data, ensuring the real-time
detection of both known and new cyberespionage and cybercriminal campaigns
targeting critical information systems.

Service highlights• A continuously high level of protection against targeted attacks and malware, with
24x7 monitoring and support from your own ‘crack team’ of Kaspersky experts,
drawing on a deep pool of specialist skills and ongoing threat intelligence.
• The timely and accurate detection of non-malware attacks, attacks involving
previously unknown tools and attacks exploiting zero-day vulnerabilities.
• Immediate protection against any detected threat through automatic antivirus
database updates.
• Retrospective analysis of incidents and threat hunting, including the methods andtechnologies used by threat actors against your organization.
• An integrated approach - The Kaspersky portfolio includes all the technologies andservices you need to implement a complete cycle of protection against targeted attacks:
Preparation – Detection-Investigation – Data Analysis – Automated Protection.

Kaspersky
Monitoring Center

TargetInfrastructure?

Kaspersky
Security Network?

The service in more detailKaspersky Targeted Attack Discovery
includes the following activities:
Gathering and analyzing data on attacks
from external sources. The aim at thisstage is to obtain a snapshot of the attack
surface of a company whose assets are,or were, being targeted by intruders. We
tap into a variety of intelligence sources,
including underground cybercriminal
communities, as well as internal Kaspersky
monitoring systems. Analyzing thisintelligence allows us to identify weaknesses
in a company’s infrastructure that are ofinterest to cybercriminals, compromisedaccounts, stolen data and much more.
Onsite data collection. This stage sees
data collected from workstations, servers,
SIEM systems and other equipment in thecustom- er’s infrastructure. Some of thedata is collect- ed using software provided
to the customer within the framework of
the service.
Data analysis. Kaspersky experts use thedata collected at the previous stage toidentify incidents in the corporate network.
The main purpose of this stage is todetermine the type of incident and assess
its impact on the infrastructure, which allows
the appropriate remediation measures tobe implemented. At this stage, data fromworkstation logs, network activity data, andother contextual and historical intelligence isused; no additional data is collected directlyfrom compromised systems.
Early incident response. At this stage
we provide interim recommendations for
initial incident response. In some cases, toconfirm and classify an incident, Kaspersky
experts may require additional data, suchas various files from operating systems,
applications and network equipment,
network traffic dumps, hard disk images,
memory dumps or other types of data.
The customer may be asked to provide
additional data (via email or various network
resources, depending on the type andamount of data requested).
Report preparation. The work carriedout within the framework of the service
culminates in a final report. It contains
the results of data analysis from externalsources, as well as descriptions of detectedattacks based on analysis of the datacollected in the customer’s infrastructure.
The report also contains remediation
recommendations for the detected attacks

Additional services
You can also ask our experts to analyze thesymptoms of an incident, perform deep
digital analysis for certain systems, identify
a malware binary (if any) and conduct
malware analysis. These optional services
report separately, with further remediation
recommendations.
We can also, on request, deploy theKaspersky Anti Targeted Attack (KATA)
Platform onto your network, permanently
or as a ‘proof of concept’ exercise. This
platform combines the latest technologies
and global analytics in order to detection
and respond promptly to targeted attacks,
counteracting the attack at all stages of
its lifecycle in your system.

Targeted Attack Discovery
Kaspersky experts provide proactive Targeted Attack Discovery service to ensure thetrue security of your business assets.
Targeted Attack Discovery results will let you identify current cybercriminal andcyberespionage activity in your network, understand the reasons behind and possible
sources of these incidents, and effectively plan mitigation activities that will help
avoid similar attacks in future. If you are concerned about attacks directed at yourindustry, if you have noted possible suspicious behavior in your own systems, or if
your organization simply recognizes the benefits of regular preventative inspections,Kaspersky Targeted Attack Discovery services are designed to tell you:
• Whether you are currently under attack, how, and by whom
• How this attack is affecting your systems, and what you can do about it• How best to prevent further attacks

How the service works
Our globally-recognized independent experts will reveal, identify and analyze ongoingincidents, advanced persistent threats (APTs), cybercriminal and cyber- espionage
activities in your network. They will help you to uncover malicious activities, understandthe possible sources of incidents, and to plan the most effective remedial actions.
We do this by:• Analyzing threat intelligence sources to understand your organization’s specificthreat landscape• Conducting in-depth scans of your IT infrastructure and data (such as log files)
to uncover possible signs of compromise• Analyzing your outgoing network connections for any suspicious activity• Uncovering probable sources of the attack, and other potentially compromised
systems
Global ThreatIntelligence
ReportingSigns ofCompromise
Customer-specificThreat Intelligence

Recomendations
for Remediation
ThreatHunting

ected
Systems

InitialResponce

Forensic DataCollection

Network Data andSystem Artifacts

The results
Our findings are delivered in a detailed report covering:• General information confirming your network is compromised or signs that it may be;• Analysis of the intelligence gathered about threats and indicators ofcompromise (IOC);• Description of possible attack sources and compromised network components;• Remediation recommendations to mitigate the impact of an incident and protect
your resources from similar attacks in future.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
Cybersecurity for SMB: kaspersky.com/business
Cybersecurity for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2019 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are the property of theirrespective owners.

We are proven. We are independent. We aretransparent. We are committed to building a saferworld, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tomorrow.
Known more at kaspersky.com/transparency