cyber.hendryadrian.com
Security News · helpnetsecurity.com

Mars Security Announces Threat-Intelligence-Based Detection Rules Tested Against Customer Data

· Original article ↗

Summary

Mars Security says its new capability turns threat intelligence into MITRE ATT&CK-mapped detection rules, backtests them against customers’ previous 30 days of data, and identifies gaps in existing detection coverage.

Key points

  • The capability converts newly published threat intelligence into detection rules intended to be ready for review within minutes.
  • Mars says rules are mapped to MITRE ATT&CK and written for connected telemetry sources, including CrowdStrike, Wiz, Splunk and cloud logs.
  • Before offering a rule, the system tests its query against the customer’s previous 30 days of data and estimates matches and false positives.
  • The system scores indicators for false-positive history and filters out those it considers too broad, too old or noisy.
  • Mars says it can identify gaps in existing detection coverage, with examples including AWS CloudTrail tampering and suspicious Microsoft Graph API activity.
  • Some recommendations for detection-as-code teams are provided as pull requests for review and merging.

Article Details

Event Type
Product capability announcement
Impact
Mars Security announced Real-Time Intel-Based Detection, which converts newly published threat intelligence into MITRE ATT&CK-mapped detection rules, backtests them against customers’ prior 30 days of data, and identifies detection coverage gaps. The company says this can reduce the delay between threat reporting and production-ready detection without changing customers’ existing security stacks.

MITRE ATT&CK

T1550.002 · Pass the HashThe article identifies pass-the-hash lateral movement as a detection coverage gap Mars recommends addressing.T1562.008 · Disable or Modify Cloud LogsThe article identifies AWS CloudTrail logging tampering as a detection coverage gap Mars recommends addressing.

People

Ran LererCTO of Mars Security; quoted describing the new capability.Shahaf GaliliCEO of Mars Security; quoted describing the new capability.

Vendors

Mars SecurityMars Security converts fresh threat intelligence into ready-to-deploy detection rules within minutes.

Products

CrowdStrike Falconthe detection in the native query language of whichever telemetry can actually see the threat: CrowdStrike Falcon, Wiz, Splunk, firewall logs, Linux Sysmon, identity providers, AWS telemetry, or data lakes such asDatabricksfirewall logs, Linux Sysmon, identity providers, AWS telemetry, or data lakes such as Snowflake and Databricks.Real-Time Intel-Based DetectionMars Security has announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated, ready-to-deploy detection rules within minutes of release.SnowflakeWiz, Splunk, firewall logs, Linux Sysmon, identity providers, AWS telemetry, or data lakes such as Snowflake and Databricks.SplunkRules are mapped to MITRE ATT&CK and built for native telemetry sources like CrowdStrike, Wiz, Splunk, and cloud logs.WizRules are mapped to MITRE ATT&CK and built for native telemetry sources like CrowdStrike, Wiz, Splunk, and cloud logs.

Related Articles