4 ms·
> ... a way for... processes to disable the generation of some security events... This technique could be used to evade EDR software So, you can disable some e
by einpoklum 3y ago
> ... a way for... processes to disable the generation of some security events... This technique could be used to evade EDR software
So, you can disable some event logging for your process in Windows. Wow, what a grand discovery.
Note also the wide use of boldface in the article. That just screams professionalism, doesn't it?
- jewillco 3y agoAn application reducing event logging to outside security software that is supposed to be monitoring it is bad.
- einpoklum 3y agoIt is bad - bad security practice to rely on voluntary app logging.
- jewillco 3y agoThe intention is that the logging isn’t voluntary, though. I believe the kernel is supposed to generate the logged events.
- einpoklum 3y ago> The intention is that the logging isn’t voluntary, though Clearly, that's not the case. It's not like the API slipped in there by mistake. Someone just assumed they can rely on the logs being available.