// IT-Leiter & Techniker

# Top Attack Vectors 2024/2025 (BSI Report)

ATTACK_VECTORS = {
    "phishing_emails": 41%,      # Credential Harvesting
    "exposed_rdp": 23%,          # Brute Force / CVE
    "supply_chain": 18%,         # SolarWinds-Style
    "unpatched_systems": 12%,    # Exchange, Log4j, etc.
    "insider_threat": 6%         # Malicious/Negligent
}

# Was im SIEM hätte auffallen müssen:

DETECTION_OPPORTUNITIES = [
    "Event 4688: Unusual child process of WINWORD.EXE",
    "Event 4624: Multiple Type 3 logins from single source",
    "Event 4672: Special privileges assigned to new logon",
    "Outbound: Large data transfer to cloud storage",
    "VSS: Volume Shadow Copy deletion attempt"
]

# AIM-IT EDR Detection Engine - Pseudocode

class ThreatDetector:
    def analyze_process(self, process):
        # Behavioral Analysis
        behavior_score = self.ml_model.predict(process.behavior)

        # MITRE ATT&CK Mapping
        techniques = self.map_to_mitre(process.actions)

        # Reputation Check
        reputation = self.threat_intel.check(process.hash)

        if behavior_score > 0.85 or reputation == "malicious":
            self.isolate_endpoint(process.host)
            self.alert_soc(priority="critical")
            self.create_forensic_snapshot(process.host)

# API Example: Endpoint Status abrufen

curl -X GET "https://api.aim-it.at/v2/endpoints" \
    -H "Authorization: Bearer ${API_KEY}" \
    -H "Content-Type: application/json"

# Response
{
    "endpoints": [
        {
            "id": "ep-001",
            "hostname": "WS-FINANCE-01",
            "status": "protected",
            "last_scan": "2024-01-15T10:30:00Z",
            "threats_blocked": 12
        }
    ]
}

# Beispielkalkulation: 100 Endpoints

BASE_PRICE = €X.XX # pro Endpoint/Monat

PACKAGES = {
    "Essential": ["EDR", "Email Security", "Basic Reporting"],
    "Professional": ["+ 24/7 SOC", "+ SIEM", "+ Incident Response"],
    "Enterprise": ["+ Custom Playbooks", "+ Dedicated Analyst"]
}

# TCO-Vergleich: Individuelles Angebot auf Anfrage