Tired Of Reactive Strategies? Proactively Stop Attackers Earlier In The Kill Chain!
Published: 2023-10-18 07:17:12


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v6ovfq3bcsy4o2fvw2q8.png)

MSSPs all deal with a crushing number of alerts daily – but how are the most successful partners managing the influx?

The [MSSP](https://stellarcyber.ai/seamless-alienvault-migration-program/) industry has seen a significant increase in attacks on MSP and [MSSP partners](https://stellarcyber.ai/partners/become-a-mssp-partner/) this year. This has led to several new attacks on everything from [RMM tools](https://stellarcyber.ai/platform/capabilities-ndr/) to applications. We all deal with a crushing number of alerts daily – so how are the most successful partners managing this?

Start with the [kill chain](https://stellarcyber.ai/platform-xdr-kill-chain/). The most popular framework today is the MITRE attack framework. If you can look at your alerts through this lens, you can begin to reduce your [SOC](https://stellarcyber.ai/mssps/soc-as-a-service/) teams’ workload significantly. Start with the reconnaissance stage. Why start there? Because if you can cut off the connections before the attackers gain a foothold, you can eliminate much of the hunting and clean-up your team is doing today.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1rebgycztmhubu8h0u5d.jpg)

A great example is [Log4j](https://stellarcyber.ai/stellar-cyber-log4j-vulnerability-and-exploitation-detection/). This has been a big nuisance for the last month or so. Many attackers are leveraging this because currently it creates so much noise. In a way it has been amplified through crowdsourcing by multiple attack groups – the more attackers using it, the more alerts you’ll see related to it.

Those initial scans don’t deliver any payload, but they do create a ton of work for your [SOC](https://stellarcyber.ai/enterprise/automated-soc/). If you can connect the scan to communication with an asset in your network, you can limit your response to actual [threats](https://stellarcyber.ai/platform/automated-threat-hunting/) to your customer. This is an area where machine learning can significantly improve your chance for success.

Leveraging unsupervised machine learning, you can baseline whether a particular machine has ever communicated with an external host or run a particular application like Log4j. More importantly, you can also detect if data is being exfiltrated. Stellar Cyber has developed a platform that can map this to the MITRE attack framework to quickly identify this behavior, stage it in the [kill chain](https://stellarcyber.ai/platform-xdr-kill-chain/), and recommend a remediation tactic. Armed with this context, you can take a much more targeted approach to responding and you will not need to purchase or deploy special [detections](https://stellarcyber.ai/platform/platform-threat-intelligence/) from multiple vendors.

In addition, if you detect a connection to a known malicious host, you can terminate the connection automatically on the firewall and on the device. With automated threat hunting rules, you can choose a detection, set the condition, and the [Stellar Cyber Platform](https://stellarcyber.ai/platform/what-is-open-xdr/) can initiate the response through integrations with your firewall and [EDR tool](https://stellarcyber.ai/with-stellar-cybers-open-xdr-no-edr-is-an-island/). Ultimately, this accomplishes three very important things:

1. Reduce time to detection of actual events.
2. Tune out the noise.
3. Automate response to reduce risk.

When you have a fully integrated platform performing these tasks, it’s simple. If you are interested in learning more, please reach out to [Brian Stoner](https://stellarcyber.ai/brian-stoner/) at Stellar Cyber.