3 ms·

Great deep dive! Always wondered about the details around this topic. Did a bit of red teaming around the topic of reverse shells and privilege escalation and

Great deep dive! Always wondered about the details around this topic. Did a bit of red teaming around the topic of reverse shells and privilege escalation and was pleasantly surprised, how much Windows Defender catches. Our IT Department recently switched away from a paid McAfee service doing end point security, which failed to detect unauthorized access in many instances. Also, I totally read the intro as "addressing the ERP use-case"

zelon88 2y ago
McAfee sold it's Entrerprise division in 2021. Ever since they have primarily focused on scaring boomers into subscription plans. They used to have an on-prem EDR platform called McAfee EPO but I think that was replaced with some cloud hosted subscription garbage. I won't use cloud based security products. On-prem security should have an on-prem solution. Anyone who says otherwise gets their paycheck by hawking servitization or hosting data. The reasons for outsourcing are weak. To your point about reverse shells, last time I tried about 2 years ago, meterpreter was still sneaking past almost everything. There are some tools on Github for detecting it, but it is very good at evading detection in general.
- lucasRW 2y ago
  Highly doubt that... to be certain about dates as these things move fast, I refer to the OSEP course from Offensive Security, which is mostly about evasion. Course released in 2021, and which became necessary after the infamous OSCP, since most payloads became detected by antivirus, which is basically the starting point of that course: a default MSF payload, even with various encoding, will trigger 50% or more of AVs on virustotal.
  - zelon88 2y ago
    So you describe a 50% failure rate and you doubt me? I believe you have a false sense of confidence in your suppliers and their products. Have fun rebuilding your house of cards over and over again. Being dismissive about security is the lowest hanging fruit there is.
    - lucasRW 2y ago
      I describe 50% of AV products detecting something you said was "sneaking past almost everything".
- gradyfps 2y ago
  McAfee ePO is the product that became Trellix ePO after McAfee Enterprise was sold off.
dspillett 2y ago
> which failed to detect unauthorized access in many instances. Did something else detect them in a timely manner, or did you find evidence later as part of some sort of audit? (or was the inadequacy found via staged penetration testing?)
Cthulhu_ 2y ago
ERP being "erotic roleplay"?
- shubb 2y ago
  You mean all those finetunes on huggingface aren't SAP copilots?

zelon88 2y ago

McAfee sold it's Entrerprise division in 2021. Ever since they have primarily focused on scaring boomers into subscription plans. They used to have an on-prem EDR platform called McAfee EPO but I think that was replaced with some cloud hosted subscription garbage. I won't use cloud based security products. On-prem security should have an on-prem solution. Anyone who says otherwise gets their paycheck by hawking servitization or hosting data. The reasons for outsourcing are weak. To your point about reverse shells, last time I tried about 2 years ago, meterpreter was still sneaking past almost everything. There are some tools on Github for detecting it, but it is very good at evading detection in general.

lucasRW 2y ago
Highly doubt that... to be certain about dates as these things move fast, I refer to the OSEP course from Offensive Security, which is mostly about evasion. Course released in 2021, and which became necessary after the infamous OSCP, since most payloads became detected by antivirus, which is basically the starting point of that course: a default MSF payload, even with various encoding, will trigger 50% or more of AVs on virustotal.
- zelon88 2y ago
  So you describe a 50% failure rate and you doubt me? I believe you have a false sense of confidence in your suppliers and their products. Have fun rebuilding your house of cards over and over again. Being dismissive about security is the lowest hanging fruit there is.
  - lucasRW 2y ago
    I describe 50% of AV products detecting something you said was "sneaking past almost everything".
gradyfps 2y ago
McAfee ePO is the product that became Trellix ePO after McAfee Enterprise was sold off.

dspillett 2y ago

> which failed to detect unauthorized access in many instances. Did something else detect them in a timely manner, or did you find evidence later as part of some sort of audit? (or was the inadequacy found via staged penetration testing?)

Cthulhu_ 2y ago

ERP being "erotic roleplay"?

shubb 2y ago
You mean all those finetunes on huggingface aren't SAP copilots?