PaperCut Activity Hunt
This is sourced directly from Sophos MDR: Increased exploitation of PaperCut drawing blood around the Internet – Sophos News
PaperCut IoC List: IoCs/papercut-nday-indicators-of-compromise.csv at master · sophoslabs/IoCs · GitHub
SELECT
date_format…
Sophos ZTNA – v2.0.2 is now available
[Update: 17th May]
A new release, Version 2.0.2, is now available. It addresses the problem with gateway upgrades that was previously reported.
Overview
Today, the ZTNA team is pleased to announce the general availability of Sophos ZTNA v2.0.2.…
3CX users under DLL-sideloading attack
Trying to run the latest 3CX; however receiving this error: f inished - errors - no such table: xdr_data
SELECT
meta_hostname,
sophos_pids,
domain,
clean_urls,
source_ips,
destination_ips,
timestamps,
ingestion_timestamp
FROM
xdr_data…
[QueryCorner][March2023] Deep Diving into OneNote Attacks
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Index
Purpose
Prerequisites
Query #1 - Live Discover - Check…
[QueryCorner][February2023] Data Lake - Sophos Firewall: Threat Hunting Dropped Logs
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Sophos Firewall uses firewall rule ID "0" in your log viewer…
[QueryCorner][February2023] Data Lake - Sophos Firewall: Port Scanning Detections
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Sophos Community has amassed an incredible catalog of queries…
[QueryCorner][February2023] Data Lake - Device: Pending Windows/Mac Updates
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
If you have not traversed the XDR journals, please review…
PowerShell script to migrate Sophos endpoint protection from current Sophos Central to new Sophos Central
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Overview
This article describes how to create a PowerShell script…
[QueryCorner][January2023] Live Discover - Network: Processes with an open network connection
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
If you have not traversed the XDR journals, please review…
Sophos Endpoint
Guys, I have a doubt. there is no more sophos product for endpoint with EDR? XDR only?
[QueryCorner][October2022] Audit Application Control
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Sophos Endpoint and Server products all come equipped with…
[QueryCorner][October2022] Deep Diving into Windows Firewall
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
The Windows Firewall is a security component to help protect…
[QueryCorner][September2022] Live Discover - Program Execution Evidence
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is taken directly from the Sophos Rapid Response…
[QueryCorner][September2022] Data Lake - IOC Hunting
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
The Great Karl_Ackerman put this query together to provide…
[QueryCorner][August2022] Live Response - Five Basics for Windows
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This post is to highlight response actions that an operator…
SIEM integration API
The script siem.py is very useful to retrieve alerts and actions on Sophos Central, but it is unable to collect data from XDR.
Is it possible to "empower" it to read XDR data? SIEM would have a complete visibility on activities done on the infrastructure…
Detections/Investigations API
Hi there,
Has anyone managed to construct API queries to pull out Detections/Investigations from Sophos XDR at all? We want these to be pushed into our ticketing platform as they are generated (or fetch them every 5 mins etc.) but I can't find any…
[QueryCorner][August2022] Deep Diving Into RDP
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Often, Remote Desktop Protocol (RDP) sessions are used…
[QueryCorner][August2022] Live Discover - IOC Hunting
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
Let's revisit a query written by Kyle Seike - post can…
[QueryCorner][July2022] Windows PCI Audit Report
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is designed to give you information required…
[QueryCorner][July2022] Live Discover Device Card - MacOS
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is designed to give you a "Total Report" of…
[QueryCorner][June2022] Data Lake Device Card - Windows
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Purpose
This query is designed to give you a "Total Report" of…
New on the Secure Block
Hey everyone, happy to be a part of this nice community. I decided to register an account as I've lurked around a fair share and actually am employed by Sophos Partner company.
Looking for some recommendations on EDR / XDR with primary focus being the…
Getting Started With Sophos Live Discover Design Mode
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Overview
This post is going to cover setting up a user created…
Query Corner Announcement and Master Index
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Overview
Here at Sophos, we launched EDR into the endpoint platform…