Active Countemeasures AI-Hunter

Analyse, Identify, Prioritise, Hunt

Active Countermeasures have created the leading, industry-defining, Network Threat Hunting platform – AI-Hunter.
Leveraging techniques from Zeek/Bro and the RITA framework, AI-Hunter collects packet information from your network and analyses the results. The AI-Hunter systems can be defined as the ‘commercial version’ of Zeek/Bro, focused on identifying compromised systems calling home to their Command & Control (C&C) servers and data exfiltration.

AI-Hunter Key Features

Identify compromised systems calling home to their Command & Control (C&C) servers and data exfiltration
Covers an unparalleled 20 techniques within the MITRE ATT&CK C&C Tactic
Tailored threat hunting to you – identify each of your system’s threat scores versus other hosts on your network
Integration with existing SIEM and security investment – keep your unified dashboard, and delve deeper into AI-Hunter when required
The most commercially affordable platform on the market – cost-effective network threat hunting, without the usual highbrowcosts
Huge Return on Investment (ROI) – quick and easy to deploy, with a ‘one license suits all’ pricing model

Tailored Network Threat Hunting

Identify your threat scores and compare them across the organisation - security across the board

Identify/Protect Compromised Systems

Cover techniques across C&C and data exfiltration - as well as 20 techniques in the MITRE ATT&CK vector

Huge Return on Investment (ROI)

The most cost-effective network threat hunting solution on the market - easy to deploy for instant threat hunting

AI-Hunter Modules

SIEM and Slack Alerting

Continuously hunt your network for C&C activity

Continuously scouring your network, AI-Hunter hunts down signs of C&C activity. When AI-Hunter identifies a backdoor, the platform notifies you via Slack, the SIEM of your choice or a centralised logging server. This technique means that your security personnel will only be needed when an actual threat is detected.

Beacons

Detects consistencies and patterns in the behaviour of backdoors

The modern day advanced backdoor are extremely hard to detect. Rather than focus on signatures for know bad actors, AI-Hunter detects consistencies and patterns in the bevaiours of these backdoors. By utilsing a selection of detection techniques, the analyst can filter and re-sort the criteria they are looking at – all on the fly.

Long Connections

Track down connections, and quickly spot suspicious activity

Attackers are known to switch up their techniques. One way in which they do this, is through ‘calling home’ and leaving the connection open – indefinitely. Spot this anomaly of traffic through the AI-Hunter long connections module allows you to quick track down and identify this suspicious act.

Blacklisted

Identify known-to-be-compromised systems

AI-Hunter’s blacklisted module enables you to identify when known-to-be-compromised systems are communicating with hosts on your internal network. Working witht aggregated results from multiple threat intelligence feeds, AI-Hunter allows you to have a singe pane of glass view to uncover highly suspicious activity.

DNS

Detect suspicious quantities through subdomains

Active Countermeasures recognise that DNS C&C is one of the most common routes for attackers to exploit secure environments. AI-Hunter detects DNS C&C through looking the number of subdomains per domain – flagging suspicious quantities and easily identifying excessive subdomains.

User Agent

Identify unexpected software communicating on your network

AI-Hunter’s user agent module identifies the operating system, browser and plug-ins used to create a HTTP connection. This is incredibly valuable seeing as most environments standardise their platforms – AI-Hunter identifies unique user agents which could be signs of unexpected software communicating on your network.

Deep Dive

Analyse a total snapshot of a host in one holistic view

We all know that sometimes you just have to dig in to a host. AI-Hunter has the ability to to show a total snapshot of a host in a single view. This allows you to deeply analyse the host and dive deeper into the different endpoints and protocols used by that particular host.

Related Events

Featured Events

Latest News

Contact Us

+44 (0) 1582 369330
+44 (0) 1158 243432 (Support)
Customer Support Portal

[email protected]

Satisnet Ltd, Suite B, Building 210, The Village, Butterfield Business Park, Great Marlings, Luton, Bedfordshire, LU2 8DL

Privacy Policy