lucasRW

10 ms·

121.
by lucasRW 2y ago
No. If an EDR relies on userland mechanisms to monitor, these userland mechanisms can easily be removed by the malicious process too.
122.
by lucasRW 2y ago
A key part of breach a network is having a beacon running on their networks, and communicating out, one way or another. Running beacons with good EDRs is difficult, and has become the most challenging aspect of most red team engagements bec
123.
by lucasRW 2y ago
Such as ?
124.
by lucasRW 2y ago
Electricity too is a SPOF.
125.
by lucasRW 2y ago
Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking sysc
126.
by lucasRW 2y ago
As a redteamer I guarantee you that a Windows endpoint without EDR is caviar for us...
127.
by lucasRW 2y ago
When it comes to security products, the size of the customer base matters. More customers means more telemetry. More telemetry means better awareness of IOCs, better training sets to determine what's good and what's bad.
128.
by lucasRW 2y ago
Good day for OSINTers, APTs, redteamers, to find out who uses Crowdstrike on their endpoints.
129.
by lucasRW 2y ago
I describe 50% of AV products detecting something you said was "sneaking past almost everything".
130.
by lucasRW 2y ago
Highly doubt that... to be certain about dates as these things move fast, I refer to the OSEP course from Offensive Security, which is mostly about evasion. Course released in 2021, and which became necessary after the infamous OSCP, since
131.
by lucasRW 2y ago
By 2024 standards, saying that a man cannot be pregnant, or that illegally coming into a country is... well, illegal, is enough to be "far-right".
132.
by lucasRW 2y ago
When you're in the field, you know, especially when you're at Project Zero, which hired a lot of former NSA TAO.
133.
by lucasRW 2y ago
Part of the game... With Crowdstrike, Mandiant, Google, Kaspersky, etc, it's hard to remain undetected these days !
134.
StripedFly malware used EternalBlue before it was leaked(usa.kaspersky.com)
2 points by lucasRW 2y ago|0 comments
135.
by lucasRW 2y ago
I know them for the Mitre Att&ck framework but apart from this, what are they known for commercially ?!
136.
by lucasRW 3y ago
More likely that the account of that dev was breawched, dont you think ?
137.
by lucasRW 3y ago
Interesting. Is there a hacking movie database for the lolz ?
138.
by lucasRW 3y ago
Quite a risky position in a society where the dominant view is the one for "safe-spaces" and "not being offended"...
139.
by lucasRW 3y ago
Not so sure. I remember that pulling the plug on SWIFT was seen and talk about, as "the nuclear option" that no one thought would be used.
140.
by lucasRW 3y ago
I can understand the move from unmanaged C to Rust for security reasons, but C Sharp to Rust ? Am I missing something here ?
141.
by lucasRW 3y ago
“They’re some of the same people that have been working behind the scenes with Congress to write legislation,” Kirkpatrick told the In the Room With Peter Bergen podcast. >> Isn't this a conspiracy theory ?
142.
by lucasRW 3y ago
Many threat intelligence companies buy that data and then resell it as a service. I'm not very clear as to how accessing that data in the first place is legal...
143.
by lucasRW 3y ago
I am shocked to realize that Firefox is that close to 2%, I thought it was way above that level. Google monopoly is to be avoided at all costs.
144.
by lucasRW 3y ago
Is that really news, or "counter-intuitive" ? I have lived in several countries and always observed that, irrespective of the political views, people try to flee poor areas when they can, and try to have their kids put in good sch
145.
by lucasRW 3y ago
Good to see some countries responding to barbarians with better weapons than balloons and candles.
146.
by lucasRW 3y ago
It's not a password though, but probably a private key, not that easy to rotate every now and then.
147.
by lucasRW 3y ago
Red teams and malicious actors have plenty of tools which automated the looting and look for juicy things. Crash dumps, logs, and many others... The bottom line is that if there is a secret stored on disk somewhere, it won't take long
148.
by lucasRW 3y ago
I like how the fact that Microsoft's normal corporate environment (ie. the one with Internet connection) being compromised is casually considered as a secondary issue here.
149.
by lucasRW 3y ago
Past a certain number of millions of dollars, a team of lawyer is effectively a legal red team who is tasked with finding bypasses (and will find them) around the restrictions in place.
150.
by lucasRW 3y ago
Wait, is that question serious or you are really prentending you don't know what "changed" in Sweden, or in another European countries, over the past 10 or 20 years :-) ?!

More ›