Ista

[Ista @IstaPee]

@0xpwnie @rootkovska she’s the OG and an amazing researcher

[Ista @IstaPee]

@Shpigford absolute legend

[Ista @IstaPee]

@HackingDave would help people see the benefits for sure

[Ista @IstaPee]

@HackingDave is there a video of the platform in action somewhere?

[Ista @IstaPee]

@dreadnode appsec only, right? not full infrastructure/endpoint AI-driven pentesting?

[Ista @IstaPee]

@TwoSevenOneT @RossMichaels328 @Defte_ correct. technically you could catch it with some advanced logging logic, i.e. host reports back via sccm that cs service is running, but splunk had not seen events from it in last 24h. very few orgs do though.

[Ista @IstaPee]

@TwoSevenOneT @RossMichaels328 @Defte_ there are some cloud-derived detections and blocks that CS does somewhat retroactively, and those would not happen once the EDR is blinded. but the core ruleset lives on the endpoint and will block/detect things even without network connectivity.

[Ista @IstaPee]

@RossMichaels328 @TwoSevenOneT @Defte_ it works in a sense that blocks and detections aren’t sent up, but the actual actions on the endpoint still take place

[Ista @IstaPee]

@hetmehtaa lost me at "cached corp creds" on a fridge

[Ista @IstaPee]

@horsepower imagine the torque steer

[Ista @IstaPee]

@unpacker could you share details of your IOC search bot?

[Ista @IstaPee]

@xorJosh @Antonlovesdnb does it detect OSX flavor of ClickFix by any chance?

[Ista @IstaPee]

@RidgelineCyber @shotgunner101 thanks for your reply. my understanding is that a lot of affected FOIAs dont generate application access logs to begin with, and since CA policy isn't evaluated until session (or conditions) expire, this generates a complete blind spot.

[Ista @IstaPee]

@Cyb3rMonk can’t dm you since I don’t have the checkmark. don’t know if x lets you message me, but I can elaborate privately

[Ista @IstaPee]

@Cyb3rMonk thanks! that scenario is the one keeping me awake at night 😀

[Ista @IstaPee]

@ex_raritas How do these searches work OSX variants where powershell string isn’t present?

[Ista @IstaPee]

@cyb3rjerry yeah i wonder what the purpose of that post is for.. guess if it succeeds, malware realizes it's in a sandbox and terminates?