
Advanced Detection and Prevention
Today’s attacks are designed to bypass your organization’s defenses, regardless of your industry or size. In fact, while 68% of observed malware appears only at one organization, 80% of observed malware appears once, period. Signature-based defenses cannot protect against single-use malware. Even more importantly, in many cases, attackers eschew malware for social engineering and other tactics.
Failure of standard detection methods
Conventional detection methods fail because they are incomplete:
- Indicators are ephemeral. They can only be used to provide information about a specific, retrospective point in time data point. They are a piece of the puzzle, but cannot tell the entire story. You need more evidence to build the context necessary to anticipate future attacks.
- Integrated perimeter controls, which include firewalls and sandboxes, often execute traffic objects sequentially, one at a time, in siloed environments and completely miss attacks that use multiple steps or non-digital steps.
- Security analytics can identify anomalies and activities that have previously been unseen. However, what informs these algorithms? Absent of knowledge of the attacker’s behavior, attacks can easily evade these defensive measures.
- Threat intelligence provides insights into the attacker’s tactics and techniques and may even correlate ongoing activity to an attacker. However, security programs can’t operationalize that knowledge into your detection architecture.
Video
Non-Malware Attacks and How to Detect Them
TESTIMONIAL
“The best product to effectively defend against zero-day malware and targeted attacks is FireEye.”
- Kunio Shimizu, Spokesperson and Certified Information Systems Auditor (CISA),
Amuse, Inc.

Customer Story
Japanese artist agency management strengthens security with FireEye solutions.
Video
Always-on detection
FireEye detection takes a different approach
A well-designed security architecture must detect even the most sophisticated attacks while ignoring the distractions of false alerts. Proven FireEye detection blends detection analytics and machine learning, with threat intelligence into the patented MVX engine to:
- Intuitively understand and codify the tools, techniques and procedures (TTPs) of attackers; evidence is broken down to an atomic level, and translated into products. Fusing detection research and analytics with visibility into the threat landscape delivers the insights to identify never before seen techniques and tools. Organizations are no longer trying to manually perform weak signal analysis to find the attack buried in the noise.
- Use continually tuned and codified intelligence to reverse engineer attacker TTPs, track malware to its source, and perform other advanced detection functions
The automated detection engine is updated at least every 60 minutes with knowledge engineering of insights captured from incident responders from the world’s most sophisticated attacks, deep research gleaned from inside attacker systems, and millions of sensors monitoring for evidence of even the most sophisticated attacks worldwide. Fusing these detection techniques and sources of insights gives you the ability to identify never-before-seen attack tactics and tools.
Related products and services
Related blogs
November 19, 2020
Purgalicious VBA: Macro Obfuscation With VBA PurgingNovember 9, 2020
WOW64!Hooks: WOW64 Subsystem Internals and Hooking TechniquesSeptember 30, 2020
Detecting Microsoft 365 and Azure Active Directory BackdoorsJuly 13, 2020
SCANdalous! (External Detection Using Network Scan Data and Automation)April 2, 2020
FakeNet Genie: Improving Dynamic Malware Analysis with Cheat Codes for FakeNet-NG
Zero-day attacks
Read more about what a zero-day attack is, why they're difficult to detect and how FireEye helps detect and combat them.
Zero-day attack white paper
A survey of zero-day attacks detected by FireEye and what they say about the traditional security model.