CrowdStrike Agentic MDR and SOC Transformation Services

CrowdStrike has announced Agentic MDR and SOC Transformation Services, designed to enhance security operations by combining machine-speed execution with expert human oversight. The Agentic MDR, delivered through Falcon Complete, integrates deterministic automation, adaptive AI agents, and elite human analysts to improve breach response times. Falcon Complete leverages Falcon Fusion SOAR and proprietary tooling to execute pre-defined response playbooks. SOC Transformation Services aim to modernize core SOC elements like SIEM, data pipelines, workflows, and talent models, enabling organizations to achieve repeatable security outcomes. These services focus on establishing foundational operating conditions for agentic SOC operations, facilitating a pragmatic path towards agentic execution and addressing the challenges of modern attacks that evade traditional defenses. The goal is to provide a trusted path for organizations to modernize and sustain their security operations effectively.

Attack Chain

While the announcement focuses on defense, understanding potential attack chains that Agentic MDR aims to defend against is crucial:

1. Initial Access: Adversaries gain initial access through various means, such as phishing, exploiting vulnerabilities, or leveraging compromised credentials.
2. Execution: Upon gaining access, attackers execute malicious code using tools like PowerShell or command-line interpreters to establish persistence and move laterally within the network.
3. Persistence: Attackers establish persistence mechanisms, such as creating scheduled tasks or modifying registry keys, to maintain access to the compromised system even after a reboot.
4. Privilege Escalation: Adversaries attempt to elevate their privileges to gain administrative control over the system, often exploiting vulnerabilities or misconfigurations.
5. Lateral Movement: Using compromised credentials or other techniques, attackers move laterally to other systems on the network to expand their reach and access sensitive data.
6. Data Exfiltration: Once they have identified valuable data, attackers exfiltrate it from the compromised network to an external location using protocols like FTP or HTTP.
7. Impact: The final objective could include ransomware deployment, data theft, or disruption of critical services, causing financial and reputational damage to the organization.

Impact

The successful exploitation of vulnerabilities and execution of sophisticated attacks can result in significant damage, including financial losses, reputational damage, and disruption of critical services. Organizations lacking modern security operations centers and facing a skills gap may struggle to defend against these threats, leading to prolonged incident response times and increased impact. Agentic MDR aims to reduce the median time to contain (MTTC) to 1 minute, significantly decreasing the impact of successful breaches.

Recommendation

• Implement and fine-tune detection rules for common attack techniques, such as PowerShell-based execution and lateral movement, to improve visibility into malicious activity.
• Modernize SIEM and logging architecture by onboarding relevant log sources, normalizing data, and developing use-case mappings, as suggested by CrowdStrike's SOC Transformation Services.
• Redesign incident response workflows for triage, escalation, containment, and recovery, aligning them with team structure, staffing model, and business risk tolerance.