CrowdStrike Inc., a leader in cloud-delivered endpoint and workload protection, today announced the release of the CrowdStrike Falcon OverWatch annual report: Nowhere To Hide, 2021 Threat Hunting Report: Insights from the CrowdStrike Falcon OverWatch Team. The report highlights an explosion in adversary activity, both in volume and velocity. CrowdStrike’s threat hunters tracked a 60% increase in attempted intrusions spanning all industry verticals and geographic regions.
The report also showcases a significant drop in average breakout time – the time it takes for an intruder to begin moving laterally outside of the initial beachhead to other systems in the network – of just one hour 32 minutes, a threefold decrease from 2020. These sobering statistics show how threat actors are constantly adapting tactics, techniques, and procedures (TTPs) to accelerate their march toward their objectives.
Additional significant OverWatch observations include:
“Over the past year, businesses faced an unprecedented onslaught of sophisticated attacks on a daily basis. Falcon OverWatch has the unparalleled ability to see and stop the most complex threats — leaving adversaries with nowhere to hide,” said Param Singh, vice president of Falcon OverWatch, CrowdStrike. “In order to thwart modern adversaries’ stealthy and unabashed tactics and techniques, it’s imperative that organisations incorporate both expert threat hunting and threat intelligence into their security stacks, layer machine-learning enabled endpoint detection and response (EDR) into their networks and have comprehensive visibility into endpoints to ultimately stop adversaries in their tracks.”
The report is comprised of threat data from Falcon OverWatch, CrowdStrike’s industry-leading managed threat hunting team, with contributions from CrowdStrike Intelligence and Services teams, and provides an inside look at the current threat landscape, notable adversary behavior and tactics, and recommendations to increase cyber resiliency. In the 2021 report, CrowdStrike’s threat hunters directly identified and helped to disrupt more than 65,000 potential intrusions – approximately one potential intrusion every eight minutes.
The mission of Falcon OverWatch is to augment the powerful, autonomous protection of the Falcon platform with smart, mission-focused expertise to deliver the outcomes necessary to stay safe. Falcon OverWatch harnesses the massive power of the CrowdStrike Threat Graph, enriched with CrowdStrike threat intelligence, to track, investigate and advise on sophisticated threat activity. The cloud-scale telemetry of approximately 1 trillion endpoint-related events collected per day, coupled with the detailed tradecraft on over 160 adversary groups, and enriched by automation of the CrowdStrike Falcon platform provides the OverWatch team with the unrivaled ability to quickly identify and stop the most advanced threat actors. OverWatch’s insights into new and novel adversary behaviors help to continuously advance the protection provided by Falcon, resulting in the proactive prevention of malicious activity on approximately 248,000 unique endpoints.
For additional information on the report, please visit the CrowdStrike website for a blog from the OverWatch team.
You can download a complimentary copy of the report here.