Quickly Identify Unusual Executable
Files with Alertica

Depending on organization specialty and size, executable files may or may not be expected in certain folders. Executable files come with a variety of different file extensions - knowing what these extensions are and where it is acceptable to be can make the difference between compromise and security.

Click the image above to enlarge

Alertica can be used for user and role based alerting, allowing for customized monitoring tailored for each department's software stack. Consider a front-end and back-end developer: while the technologies these users employ work closely with each other, distinct file signatures can often be expected in their working directories and identifying deviations from this can assist with environment cleanup and spark conversation on software development procedure.

Click the image above to enlarge

Another strategy attackers use is a double file extension. This is commonly used by threat actors alongside social engineering to coerce users to double click an executable disguised as a document or other piece of media. Locating these files as they make it onto a filesystem can provide a valuable starting point for incident response - giving opportunity to stop these attacks before they even begin.

Click the image above to enlarge

Adversaries also frequently leverage native operating system mechanisms like scheduled tasks and startup folder entries for persistence. These allow malicious scripts or executables to be triggered without attacker interaction. Monitoring these locations for new or altered files is essential for incident responders to detect unauthorized activity promptly.

Click the image above to enlarge

By identifying suspicious executable files across your environment in real time, Alertica helps organizations identify and respond to malware threats quickly and efficiently.