Does anyone know if Security Analytics (Netwitness) can help us finding this new attacks?
links about the attack:
Since this question relates to NetWitness, I've moved your post to the https://community.rsa.com/community/products/netwitness?sr=search&searchId=3c9d3075-1c82-42a7-9388-2... product space for you to get an answer.
regards to detecting malware, there are two ways Network layer and Endpoint layer in Netwitness suite of products. For actual identification of any malware executable which is fileless in nature can be identified by RSA netwitness endpoint. The comparison of disk and memory provides the necessary detection capabilities to conclude on such detonations on endpoints. Also, our endpoint provides the network connection visibility in addition to threat intel feeds and IIOCs for further analysis and forensics on such executables.
in nutshell, you will not be able to detect and conclude fileless malware at packet or log layer without the actual netwitness endpoint. This is a complete story and all threads need to be matched.