EDR Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/edr Exploring the intersection of cybersecurity, psychology, and resilience. Wed, 14 Apr 2021 18:27:44 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 https://jeanchristophvonoertzen.com/wp-content/uploads/2020/10/favicon-4.png EDR Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/edr 32 32 Webinar Takeaway: Your Free and Open Source EDR Options! https://jeanchristophvonoertzen.com/webinar-takeaway-your-free-and-open-source-edr-options https://jeanchristophvonoertzen.com/webinar-takeaway-your-free-and-open-source-edr-options#respond Thu, 04 Mar 2021 21:00:53 +0000 https://jeanchristophvonoertzen.com/?p=413 My key takeaways carbon black was one of the first vendors as "black box flight recorder" mitr uses cobalt strike and power… to simulate attacks Good comparison: https://attackevals.mitre-engenuity.org/enterprise/evaluations.html?round=APT29 container security: Wazuh can inspect docker containers, carbon black was working with VMware, not docker or kubernetes to start a hunt in velociraptor, hit the play button […]

The post Webinar Takeaway: Your Free and Open Source EDR Options! appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-your-free-and-open-source-edr-options/feed 0 Webinar Takeaway: Black Hills Infosec: Sacred Cash Cow Tipping 2021 https://jeanchristophvonoertzen.com/webinar-takeaway-black-hills-infosec-sacred-cash-cow-tipping-2021 https://jeanchristophvonoertzen.com/webinar-takeaway-black-hills-infosec-sacred-cash-cow-tipping-2021#respond Thu, 11 Feb 2021 21:00:59 +0000 https://jeanchristophvonoertzen.com/?p=379 My key takeaways EDR loader: may execute shellcode Most EDR are on cloud Receipe to pwn such EDR: get IP’s for the vendors (usually whitelisted) create a windows firewall rule to block these IPs EDR pwnd EDRs are blind to WSL(2) since 2018 Files >50MB are usually ignored by EDRs Rust, GoLang, Nim to bypass […]

The post Webinar Takeaway: Black Hills Infosec: Sacred Cash Cow Tipping 2021 appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-black-hills-infosec-sacred-cash-cow-tipping-2021/feed 0