February 11

Webinar Takeaway: Black Hills Infosec: Sacred Cash Cow Tipping 2021

Security

0  comments

My key takeaways

  • EDR loader: may execute shellcode
  • Most EDR are on cloud
    • Receipe to pwn such EDR:
      • get IP's for the vendors (usually whitelisted)
      • create a windows firewall rule to block these IPs
      • EDR pwnd
  • EDRs are blind to WSL(2) since 2018
  • Files >50MB are usually ignored by EDRs
  • Rust, GoLang, Nim to bypass EDR
  • A lot of maleware ist still written in Delphi
  • EDR look for comments in code
    • no comments, no cry

Env

Tags

EDR, webinar takeaway

You may also like

Webinar Takeaway: How to Get Started in Cyber Threat Hunting

My key takeaways responding to alerts, writing sig’s, checking dashboards is reactionary; threat hunting is proactive @TayandYou <- nice example of an AI being out of control how can AI solve infosec problems, unless we have our processes right? ThreatH process start with the network and look for anomalies suspect system? pivot to host logs

Read More

Webinar Takeaway: How to Build a Phishing Engagement – Coding TTP´s

My key takeaways Automation tools like Ansilble, terraform and docker can also create a evil environment eg for phishing Don’t put sensible tokens or passwords in ainsible config files but use a cloud password manager and pull the pass as variable into ainsible Best of phishing themes: give away 2 iPhones or check a link

Read More
Leave a Comment