3 ms·

My employer was bit by this on Wednesday. Thankfully we had Crowdstrike on it which blocked any real damage. But it definitely moved our cloud migration from “l

My employer was bit by this on Wednesday. Thankfully we had Crowdstrike on it which blocked any real damage. But it definitely moved our cloud migration from “later this year” to “later this month”. Also, not having confluence for a day exposed just how reliant we were on it for day-to-day activities.

vasco 5y ago
> Thankfully we had Crowdstrike on it which blocked any real damage For someone not familiar with their products, what did they do for you specifically?
- wcchandler 5y ago
  For us specifically they blocked the server from downloading more assumedly dangerous tools. Blocked more privilege escalation and blocked crypto mining software from running. Our teams were also able to do a “network isolation” and essentially bring the server offline quickly, without touching more pieces and possibly exposing our credentials or tokens. We also had the paid Overwatch protection which is Crowdstrikes 24/7 security monitoring solution which resulted in an actual person emailing half our team at 1am letting us know this was happening and their recommended remediation steps.
  - deleted 5y ago
    [deleted]
- SV_BubbleTime 5y ago
  I would explain it as next gen antivirus. Looks closer at hashes and heuristics of all data in and out to a server. It seems crazy that everything that is read or written is hashed and compared to a db, but it works. FWIW, we dumped crowdstrike for Cisco AMP and have been happy.
darkwater 5y ago
Security is planning to implement here CrowdStrike in the near future... does it run on every single server?
- sjg007 5y ago
  Yes.
- jamesfinlayson 5y ago
  It runs on every server that you install it on (currently happening at my company - lots of servers owned by lots of different departments need to have it instaked).
ccozan 5y ago
Got hit too. We are moving to cloud in 3 days! Tip: adding noexec to /tmp helped.

vasco 5y ago

> Thankfully we had Crowdstrike on it which blocked any real damage For someone not familiar with their products, what did they do for you specifically?

wcchandler 5y ago
For us specifically they blocked the server from downloading more assumedly dangerous tools. Blocked more privilege escalation and blocked crypto mining software from running. Our teams were also able to do a “network isolation” and essentially bring the server offline quickly, without touching more pieces and possibly exposing our credentials or tokens. We also had the paid Overwatch protection which is Crowdstrikes 24/7 security monitoring solution which resulted in an actual person emailing half our team at 1am letting us know this was happening and their recommended remediation steps.
- deleted 5y ago
  [deleted]
SV_BubbleTime 5y ago
I would explain it as next gen antivirus. Looks closer at hashes and heuristics of all data in and out to a server. It seems crazy that everything that is read or written is hashed and compared to a db, but it works. FWIW, we dumped crowdstrike for Cisco AMP and have been happy.

darkwater 5y ago

Security is planning to implement here CrowdStrike in the near future... does it run on every single server?

sjg007 5y ago
Yes.
jamesfinlayson 5y ago
It runs on every server that you install it on (currently happening at my company - lots of servers owned by lots of different departments need to have it instaked).

ccozan 5y ago

Got hit too. We are moving to cloud in 3 days! Tip: adding noexec to /tmp helped.