Netskope Threat Protection

This forum is dedicated to the the threat protection component of the Netskope Platform. Here you will find configuration guides, best practice documents, reports, and a discussion corner where you can submit any questions related to the technologies deployed in the Netskope Threat Protection platform.

  • 9 Topics
  • 0 Replies

9 Topics

ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Welcome to the Netskope Threat Protection Forum!

This section of the forum is dedicated to the Netskope Threat Protection technology. In this section you will find configuration guides, reports, research documents, and in general a space where you can submit questions and be informed about the multiple features of our threat protection capabilities, including Behavior Analytics (UEBA) and Remote Browser Isolation (RBI).Everything You Always Wanted to Know About Threat Protection* But Were Afraid to Ask!Useful resources: Netskope Threat Labs Homepage Cloud and Threat Reports (published on a quarterly basis and focused on a specific topic) Threat Labs Reports (published on a monthly basis and focused on a specific topic, or a specific geographical region) Upcoming Events Recent Blog Posts (contains the links to the Netskope Threat Labs statistics published on a monthly basis)

350
ppasseri
Netskope Employee
22 days ago
M
Netskope Employee
MandeepNetskope Employee
published in Netskope Threat Protection

‘Patient Zero’ Real-time Protection PolicyF.A.Q.

Netskope Global Technical Success (GTS)KB - ‘Patient Zero’ Real-time Protection Policy(Netskope Cloud Sandboxing) ObjectiveUnderstanding the Significance of Patient Zero in Cybersecurity: Building a Robust Defense via Netskope Prerequisite.Netskope Advanced Threat Protection license is required. ContextThis article explores the significance of Patient Zero events, emphasizing the need to take it seriously in cybersecurity defense strategies. It outlines creating a Real-time policy to mitigate Patient Zero events and provides insights into addressing common queries associated with Patient Zero events Reference https://docs.netskope.com/en/netskope-help/data-security/threat-protection/creating-a-threat-protection-policy-for-patient-zero/ Do you know?Before we proceed, let me address some foundational questions: What is Patient Zero?"Patient Zero" typically refers to the initial infection or point of entry in a cyber attack scenario. It represents the first victim or system to be compromi

150
M
Netskope Employee
7 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

New from Netskope Threat Labs: Evil Ant, Azorult, and Segmented Threat ReportsNews

NETSKOPE THREAT LABS Evil Ant, Azorult, and Segmented Threat Reports Evil Ant Ransomware Evil Ant is a new Python-based ransomware with a hardcoded key, which makes recovering files without paying the ransom possible. An Evasive Azorult Campaign Netskope Threat Labs uncovered a new Azorult campaign using HTML smuggling, reflexive code loading, and AMSI bypass to try to evade detection while stealing crypto wallets, login credentials, browser files, and important documents.Segmented Threat ReportsNetskope Threat Labs has published five new region-specific and industry-specific threat reports.Canada Japan Financial Services Healthcare Retail Anyone can subscribe to this mailing list on the Netskope Threat Labs page: https://www.netskope.com/netskope-threat-labs#subscribe

240
ppasseri
Netskope Employee
11 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Stats for February 2024

As we do every month, we have published the Threat Labs Statistics for February 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries and the return of GitHub to the top three. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware. In February, 49% of all malware downloads originated from a record-setting 215 distinct cloud apps. The top malware families active in February included the banking trojan Grandoreiro, the RAT AdWind, and the ransomware Lockbit. Cloud Malware Delivery Attackers attempt to fly under the radar by delivering malic

650
ppasseri
Netskope Employee
22 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Stats for January 2024

As we do every month, we have published the Threat Labs Statistics for January 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and SharePoint were again in the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 49% of all malware downloads in January originating from 178 cloud apps. A wide variety of malware families were circulating in January. Malware families including the Infostealer AgentTesla, the RAT AdWind, and the ransomware Lockbit and Trigona were among top families. Cloud Malware Delivery Attackers attempt to fly under the rad

520
ppasseri
Netskope Employee
22 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Report: HEALTHCARE 2024

Another monthly Netskope Threat Labs report. This edition is dedicated to healthcare. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the healthcare sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Although Microsoft OneDrive is the most popular app in the healthcare sector, its popularity lags behind that of other industries. The popularity of other Microsoft products was mixed, with SharePoint similarly lagging other industries but Teams leading other industries.Cloud App Abuse: Microsoft OneDrive was also the most popular app for malware downloads but lagged behind other industries, underscoring that successful malware delivery depends on both adversary tactics and user behavior.Malware & Ransomware: Among the most prevalent malware families targeting victims

470
ppasseri
Netskope Employee
22 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Report: FINANCIAL SERVICES 2024

The first Netskope Threat Labs report of 2024 is dedicated to financial service. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Microsoft OneDrive, Microsoft Teams, and SharePoint are among the top five most popular apps in the financial services sector, with Microsoft Teams being significantly more popular than it is in other industries. As in other sectors, Microsoft OneDrive still takes the top spot.Cloud App Abuse: OneDrive, Github, and SharePoint are the top three most popular apps for malware downloads in the financial services sector. Users in financial services download malware from GitHub and Microsoft SharePoint more frequently than users in other industries.Malware & Ransomware: A

390
ppasseri
Netskope Employee
22 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
posted in Netskope Threat Protection

Threat Labs Report — Canada 2024

The is first Netskope Threat Labs report of 2024 dedicated to a specific geographical region. A public version of the same report is available here.The Netskope Threat Labs Report highlights a different segment every month. This report series aims to provide strategic, actionable intelligence on active threats against users in each segment. The segment highlighted in this report is users working in Canada. In This Report Cloud App Adoption: Microsoft OneDrive, the most popular app worldwide, is even more popular in Canada than in other parts of the world, with the rest of the Microsoft 365 ecosystem following a similar trend.Cloud App Abuse: More than half of all malware downloads in Canada come from cloud apps, with a significant percentage coming from Microsoft OneDrive and GitHub.Malware & Ransomware: Among the most prevalent malware families targeting victims in Canada are the remote access Trojan NjRat, the Trojan Formbook, and the infostealer AgentTesla. Cloud App Adoption Th

0
ppasseri
Netskope Employee
22 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Real-time Threat Protection and AV-TEST ResultsBlog

Public version, available here.By Tom ClareNetskope continues to advance inline threat protection capabilities and has improved its detection and blocking of malware and phishing attacks while also lowering and improving its false positive rate in the latest AV-TEST Report. In every part of the testing, Netskope improved.Today more than half of user egress traffic involves applications and cloud services rather than websites, and where more than half of threats are delivered knowing these popular domains are allowed, or worse yet bypassed from inline threat inspection altogether. Relying on endpoint protection for executable malware leaves a blind spot for fileless attacks using fake login forms and phishing techniques hosted in applications and cloud services that require inline content and context inspection to protect users. This dynamic changes the playing field for threat protection testing and what must be prioritized with respect to detection speed and efficacy scores.First, use

960
ppasseri
Netskope Employee
22 days ago

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
Show all badges
Terms & ConditionsCookie settings