CCleaner: how to use Perch to confirm you weren't compromised
Wes Spencer on September 21, 2017
Cisco’s Talos research team published a blog post Monday covering another supply chain attack involving CCleaner, the well-known and popular system maintenance software. According to Cisco: For a period of time, the legitimate signed version of CCleaner 5.33 being distributed by Avast also contained a multi-stage malware payload that rode on top of the installation of CCleaner. Attacks like this against a trusted supply chain between the software manufacturer and the customer are a growing attack vector due to its potential effectiveness and impact.
Release Notes
August 28, 2017
New Perchybana really loves all the recent attention. To help you really appreciate her beauty, we’ve added a convenient button on each alert that will take you directly to Perchybana with the data filtered just to that alert’s details. Triage alerts just like the pros. New Paginate all the things! We’ve revamped how we handle larger data sets in Perch and how that data is fetched from our servers: Pagination added to: the Community Dashboard recent indicators so you can check out all that juicy community intel (last 10,000 indicators only, for now), not just the most recent 5.
Release Notes
August 11, 2017
- Suppressions load slowly, we know; this is the first step in fixing that
- More coming soon.
- New health details
- Graph scales that make sense
- CPU info display
- And the displayed detection drop percentage precision increased by 100% (Re: now we show two decimal places instead of one.)
- No one is happy when sensors aren’t able to do their thing. We’re making our sensor reporting more robust and being more aggressive about what conditions we monitor. Our periodic sensor health reports contain more details and warn about more conditions.
Release Notes
July 28, 2017
Fishtech Group today announced a strategic investment in Perch Security, the information security maverick that combines innovative application design with an in-house security operations center (SOC). This new partnership seeks to expand Perch’s sales and marketing efforts, and to broaden and accelerate product development.” READ THE PRESS RELEASE
Release Notes
July 14, 2017
- Shows last 48 hours only (instead of all time)
- Updates in real-time (instead of once daily)
Release Notes
June 30, 2017
- Detection graph to see traffic level trends
- Warning/down state for unchanging detection counts
- Private IPs counts: how many unique IPs in each of the private IP blocks has a sensor seen (You have 1000 hosts on your network, but Perch is only seeing 10 of them)
- More notifications, for both success and errors
- Standard success/error look
- Global: SOC can suppress for all users at once
- Community: SOC and community admins can suppress an indicator for an entire community
- (coming soon, work complete, in-review and testing) by-IP: suppress for a single IP
- Storing the indicator counts
- Computing the count correctly
- Lots of expensive tech words = faster databases = more responsive Perch = happier users
- Infrastructure work to ensure that as Perchy’s flock grows (and it is growing!), he can still respond to all of the data as fast as possible!
- Migration to ElasticSearch 5
National Health Care Information Sharing and Analysis Community (NH-ISAC) has rolled out an offer for their members that incorporates Perch’s “extremely affordable and simple way to detect and mitigate against threats.” READ THE PRESS RELEASE
Release Notes
June 2, 2017
- Manage API token and credentials in Perch
- Get token, backtest observables, profit!
- Global: the Perch SOC will be able to suppress false positives for every group in a single action; we’ll be able to clean up the noisy, false positive intel more quickly so that the gems with real value can shine through.
- Community: community leaders will be able to groom their own intel from within Perch; a community that preens together, stays together, right?
- Individual Host: have a single host that you know triggers a FP, but you don’t want to completely ignore the indicator for other hosts? Now you can suppress an event for just one of them.
- Consolidated view of all of your group’s sensors and their health
- Warnings for low resources and abnormal conditions:
- Old rules and low rule counts
- Sensor not uploading data
- In the Admin menu: Sensor Summary
- Old rules and low rule counts
- Perch takes the list of unmonitored network subnets for your group and sends it to the sensor so that it knows to ignore those networks in its detections.
- Results in less work for the sensor, allowing us to do more with the hardware; less data sent to Perch, less outgoing network traffic for you, and less to process and store for us! It’s a genuine win-win paradigm-shifting value add, look at all this synergy! Give Canute and Chris a raise, this is amazing!
Perch detected Grizzly indicators (before it was cool)
Chris Fauerbach on January 25, 2017
Just like always, Perch detected indicators for the infamous Grizzly Steppe minutes after DHS released them. Read about how we were able to diffuse any panic or confusion for our users before “the Russians are coming” even hit the news that day. Check out the full article here.