How Magnet AXIOM Cyber Can Be a Critical Tool in Your Incident Response Investigations

Incident Response is an important process within your organization that helps safeguard your IP, client and employee records, and ultimately the livelihood of your employees. Many companies today, large or small, are facing cyber attacks constantly.

With the proliferation of technology and likewise the increased reliance of cloud services and storage, cyber attacks are increasing in size, complexity, and cost to the victim organization. In 2019, the average cost of a data breach was $3.92 million dollars; and according to IBM’s 2019 Cost of a Data Breach report, an average of +25,000 records are compromised at a cost of $150 each.

Unfortunately it’s not necessarily a question of if a data breach will occur, but more appropriately: when.

A critical step of the IR process is the Analysis stage. This stage is key to understanding exactly what happened and how so that your learnings can be used to harden your processes and network as well as being used to potentially recover stolen data or money.

Magnet AXIOM Cyber enables forensic examiners to quickly and easily perform IR investigations such as malware or ransomware, APT cases, phishing, BEC scams, to name a few.

Watch this video to see our Forensic Consultant, Tarah Melton, give you an idea about how to use AXIOM Cyber for your IR investigations.

“Magnet helped me quickly identify a ransomware attack and find patient-zero with the Timeline feature!”

—John Wyatt, Digital Forensic Investigator Large Enterprise Telecommunications Company

Here are some other useful ways that our customers have been using AXIOM Cyber to help them with their IR investigations:

• Memory – Remotely acquire memory and process it with common Volatility plugins directly integrated into AXIOM Cyber enabling you to analyze running and hidden processes, network connections, and more
• Artifacts-First Approach – Analyze file system and memory with an artifacts-first approach that immediately identifies hidden processes and artifacts like Windows Event Logs, USN Journal, $LogFile, Prefetch, Jumplists, LNK files, and hundreds more
• Timeline – Track down malware using relative time filters that you can configure for time ranges that are specific to your examination
• Connections – Use Connections to see how processes and files are interacting with artifacts and learn how and when an endpoint got infected
• Audit Logs – Email phishing is the most common delivery method of malware to unsuspecting victims. AXIOM Cyber allows you to use admin or user credentials to login to Office 365 & G Suite and collect and examine audit logs

Try Magnet AXIOM Cyber for your next IR case by requesting a free trial today!