{"id":7264,"date":"2025-04-17T11:20:00","date_gmt":"2025-04-17T08:20:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/?p=7264"},"modified":"2026-06-14T10:24:54","modified_gmt":"2026-06-14T07:24:54","slug":"staying-protected-with-mdr","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2025\/04\/17\/staying-protected-with-mdr\/","title":{"rendered":"Staying protected with ESET MDR"},"content":{"rendered":"

<\/p>\n

ESET World 2025<\/a><\/strong> was an event that brought together top cybersecurity experts from all walks of life, so you\u2019d expect tangible examples of what makes a business really stay secure. That\u2019s exactly what James Rodewald, security monitoring analyst at ESET did.<\/p>\n

<\/p>\n

<\/p>\n

During the session titled \u201cStaying protected with ESET MDR,\u201d Rodewald pointed out the critical pain points of IT admins and how managed detection and response (MDR) saves them time and unlocks new efficiencies, as well as sharing a story about a VPN gone rogue.<\/p>\n

<\/p>\n

<\/p>\n

 Day in the life of an IT admin<\/h3>\n

<\/p>\n

<\/p>\n

Usually, IT admins need to split their focus between many areas, and security is just another small part of their tasks, often getting less attention than necessary.<\/p>\n

<\/p>\n

<\/p>\n

Of the many issues surrounding a company\u2019s cybersecurity, their budgets<\/strong> are a key concern \u2014 proper security operations centers (SOCs) can be pricy, as covering hundreds of seats takes time<\/strong> and effort. Some companies assume that having two people cover an entire SOC\u2019s capabilities is enough though, but Rodewald strongly disagrees: \u201cThey wouldn\u2019t be able to monitor 24\/7. \u2026 If something happens while they\u2019re asleep or possibly on vacation, that could be really bad<\/em>.\u201d<\/p>\n

<\/p>\n

<\/p>\n

\"IT
An average IT admin’s pain points<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

While Rodewald doesn\u2019t want to deter IT professionals from trying, he highlights that there are certain gaps that only security experts can fill: \u201cIT admins are smart. They\u2019re great at what they do. They make these beautiful systems that all communicate with each other \u2014 and that\u2019s amazing. But sometimes they don\u2019t know how<\/strong> to notice when somebody else is maliciously managing their network. And that\u2019s where the dangers come in<\/em>.\u201d<\/p>\n

<\/p>\n

<\/p>\n

ESET MDR to the rescue!<\/h3>\n

<\/p>\n

<\/p>\n

Securing added resources for IT admins to fight threats while they take care of daily tasks is what ESET MDR<\/a> offers in spades. This is rather helpful for smaller businesses lacking security headcount within their IT departments, quickly leveling up their postures. \u201cIt\u2019s like you set it and forget it. \u2026 Customers want somebody to monitor and be notified if something happened, what we did to remediate it, are there any actions they need to take<\/em>,\u201d said Rodewald about the service.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

ESET MDR is a 24\/7 threat management service<\/a> for smaller organizations, using AI and human expertise for premium protection without in-house security specialists. Let ESET block, stop, and disrupt malicious behavior in just 20 minutes while you focus on core competencies.<\/p>\n

<\/p><\/blockquote>\n

<\/p>\n

<\/p>\n

While a basic MDR service can offer enterprise-grade security, with monitoring performed by earnest experts trained to stop security incidents (using top threat intelligence to empower their decisions), a lot more can be done for complex environments with a larger footprint. These environments need a specific approach, slotting in naturally to the existing security apparatus of a larger organization.<\/p>\n

<\/p>\n

<\/p>\n

\"ESET
ESET tailors its managed services for different business requirements<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

As Rodewald said, ESET MDR Ultimate<\/a> (MDRU) is \u201cfor those customers that want to live with us<\/em> in real time as we monitor their environment \u2026 benefits range from custom rule and alert creation, [to] optimizing the security environment \u2026 to finding unprotected devices, etc. So, across the range of these activities, we drive both operational and process maturity, help with remediation, and even flag those unprotected devices, sadly an all-too-common source of threats.\u201d<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

ESET MDRU<\/a> perfectly combines ESET technology and digital security expertise to effectively and proactively detect and respond to any threat. It is a tailored service, acting as a SOC-like security umbrella, with the ability to protect sophisticated environments with dedicated security teams.<\/p>\n

<\/p><\/blockquote>\n

<\/p>\n

<\/p>\n

Rodewald also highlighted ESET MDRU\u2019s reports, explaining how the process is more human, connecting experts from both sides to design better protection rules and mechanisms in tandem, which adds even more value.<\/p>\n

<\/p>\n

<\/p>\n

Maintaining 20 minutes to detect<\/h3>\n

<\/p>\n

<\/p>\n

The ESET MDR service tier maintains a 20-minute time to detect<\/a><\/em><\/strong> for all customers \u2014 currently having a 1-minute time to react<\/strong> and around a 5-minute time to resolve<\/strong> an incident. This is owed to 24\/7 SOC-like monitoring, with our MDR teams constantly improving their decision-making processes with every single detection.<\/p>\n

<\/p>\n

<\/p>\n

\"MDR
Mean time to detect and respond for ESET MDR<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

To achieve this fast detection and response rate, Rodewald elaborated on ESET MDR\u2019s training regime: \u201cThe way we train is to ask the question, could we have spotted this sooner? Because if we can improve, then we want to improve. Also, would you be able to identify this [threat] if you saw it in the wild?<\/em>\u201d Relevant teams also examine research so they might better identify issues they hadn\u2019t yet encountered.<\/p>\n

<\/p>\n

<\/p>\n

As a result, ESET\u2019s MDR teams can actively isolate false positives from real detections, apply novel incident response playbooks as needed, and manage trainings to keep analysts up to date on threats. For in-house teams (especially IT generalists), this might be a tough nut to crack, but it\u2019s the vicious cycle that ESET security monitoring analysts are trained for.<\/p>\n

<\/p>\n

<\/p>\n

Storytime with James<\/h3>\n

<\/p>\n

<\/p>\n

In a story about an ESET MDRU success, Rodewald spoke of how a VPN gone rogue led to FIN7<\/a> getting on a business\u2019s network. The company in question, which owns a large network with multiple sites globally, was unknowingly breached prior to onboarding its ESET service (at least two to three months before). While it had an XDR solution employed, no one was monitoring it \u2014 a recipe for disaster.<\/p>\n

<\/p>\n

<\/p>\n

Before the storm<\/h4>\n

<\/p>\n

<\/p>\n

In the beginning, someone had used PowerShell to create an external network connection, leading to a renamed remote monitoring and management (RMM) tool being installed (LiteManager<\/em>). The PowerShell also had an interesting script called \u201cPowerTrash<\/a>,\u201d which was over 6,000 lines long.<\/p>\n

<\/p>\n

<\/p>\n

\"PowerTrash
Contents of PowerTrash<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

Next, the RMM tool, renamed to romfusclient.exe<\/em>, started another execution chain to install an OpenSSH<\/a> backdoor: \u201cThis backdoor would communicate with a remote C&C [command-and-control] server and allow whoever was in control to tunnel through this device to target other devices on the network<\/em>,\u201d said Rodewald.<\/p>\n

<\/p>\n

<\/p>\n

\"RMM
LiteManager RMM being executed as romfusclient.exe<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

 How ESET MDRU helped<\/h4>\n

<\/p>\n

<\/p>\n

Shortly after ESET MDRU\u2019s onboarding, monitoring picked up on lateral movement via remotely scheduled tasks \u2014 another instance of PowerTrash was being executed: \u201cIts goal was to dump credentials and load Spy.Sekur<\/strong> into memory. At this point, we knew it was FIN7<\/strong> because Spy.Sekur is only used by FIN7<\/a>, and PowerTrash, I believe, is also exclusive to FIN7<\/em>,\u201d commented Rodewald. The latter was 41,000 lines of code, much longer than the previous instance.<\/p>\n

<\/p>\n

<\/p>\n

\"PowerTrash
New PowerTrash being executed to dump credentials and load Spy.Sekur<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

\u201cWe started to see other lateral movement as we were creating custom rules to block things. \u2026 And we started to see this via both remote tasks and WinRM<\/a>. We saw that their goal this time was to execute a batch file to execute a renamed version of RClone.exe in order to back up the file shares of the network and then use a renamed copy of 7-Zip to compress that all before they would then exfiltrate it<\/em>,\u201d Rodewald continued.<\/p>\n

<\/p>\n

<\/p>\n

\"rclone
Lateral movement and data collection attempts detected<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

 Killing and blocking<\/h4>\n

<\/p>\n

<\/p>\n

The MDR team then started to kill and block these processes while creating custom rules to disable them permanently. Nevertheless, this was happening across multiple devices, with multiple forms of lateral movement.<\/p>\n

<\/p>\n

<\/p>\n

Since the MDR team had the source IPs of each of those movements, it understood that it had to locate unprotected devices in the customer\u2019s environment because they weren\u2019t showing up inside ESET PROTECT or ESET Inspect as being managed. \u201cSo, we\u2019re on the phone at this point, and I\u2019m having them remote me directly into these devices so I can see what\u2019s going on. We found OpenSSH backdoors on multiple different devices \u2014 we needed to either have the client cut them off the network, or I needed to manually remediate the[m]<\/em>,\u201d said Rodewald.<\/p>\n

<\/p>\n

<\/p>\n

\"WinRM
Unprotected devices found<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

However, the adversary wasn\u2019t done. Likely panicking as they were losing access, they dropped a new tool: \u201cIt was a never-before-seen DLL side-load<\/a>!<\/em>\u201d exclaimed Rodewald. While the .exe may have been seen in the wild before (TopoEdit) it included a malicious DLL.<\/p>\n

<\/p>\n

<\/p>\n

\"DLL
The adversary tries a DLL side-load<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

\u201cThey were trying to stay on the network. \u2026<\/em> We spotted that in less than 30 seconds<\/em><\/strong>,\u201d said Rodewald with a smile. Thus, the MDR team blocked the clean .exe<\/em> and the DLL and remediated it from about six or seven other devices, all within the same time frame.<\/p>\n

<\/p>\n

<\/p>\n

Back to the origin<\/h4>\n

<\/p>\n

<\/p>\n

In parallel, the team became curious to investigate how initial access occurred: \u201cWe started pulling logs from devices, trying to find the trail of events \u2026 so we were doing digital forensic [incident] investigation<\/em>.\u201d Before they got too deep into that investigation, the threat actors showed their cards: Someone was using Remote Desktop Protocol (RDP) from private IPs<\/a> to access different devices and immediately installing AteraAgent<\/em> with Splashtop<\/em> \u2014 two other RMM tools.<\/p>\n

<\/p>\n

<\/p>\n

However, these IPs were on a specific subnet that was different from other devices on the network, which were quickly confirmed by the business\u2019 admin as addresses assigned by the client\u2019s VPN.<\/p>\n

<\/p>\n

<\/p>\n

\"VPN
The MDR team discovers rogue devices on the VPN<\/figcaption><\/figure>\n

<\/p>\n

<\/p>\n

\u201cTheir VPN appliance was compromised<\/a>. They had rogue devices owned by the threat actor joining the VPN and then RDPing to other devices<\/em>,\u201d Rodewald revealed. Hence, the MDR team had the company shut down its VPN, with no new activity since, though it is still being monitored.<\/p>\n

<\/p>\n

<\/p>\n

This story highlights how thanks to the close-knit cooperation enabled by the ESET MDRU service, immediate action was taken, quickly developing new playbooks and security strategies for the client to prevent future incidents.<\/p>\n

<\/p>\n

<\/p>\n

Prevention-first security<\/h3>\n

<\/p>\n

<\/p>\n

The key value of ESET\u2019s MDR services lies in its prevention-first quality<\/a>. With each of ESET\u2019s managed services tackling different company architectures, the goal is the same \u2014 unlocking fast detection and almost immediate remediation, tackling novel threats before they can cause mischief.<\/p>\n

<\/p>\n

<\/p>\n

Plus, as evidenced by Rodewald\u2019s rogue VPN story, perhaps going for a managed service even while experiencing a compromise can enable businesses to snatch a security win from the creeping tentacles of a breach.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

ESET World 2025 was an event that brought together top cybersecurity experts from all walks of life, so you\u2019d expect tangible examples of what makes a business really stay secure. That\u2019s exactly what James Rodewald, security monitoring analyst at ESET did. During the session titled \u201cStaying protected with ESET MDR,\u201d Rodewald pointed out the critical pain […]<\/p>\n","protected":false},"author":5,"featured_media":7268,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[167],"tags":[],"class_list":["post-7264","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/7264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/comments?post=7264"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/7264\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media\/7268"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media?parent=7264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/categories?post=7264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/tags?post=7264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}