4 ms·
Agents don't just read env vars and send them to SIEM. There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that
by hello_moto 2y ago
Agents don't just read env vars and send them to SIEM.
There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that any EDR software in this beautiful planet would have tracked.
- st3fan 2y agoNo it logs every command macOS runs or that you type in a terminal. Either directly or indirectly. From macOS internal periodic tasks to you running “ls”.