Joe Lane

[Joe Lane @jrodericklane]

@NathanMcNulty @xenappblog @UK_Daniel_Card @IAMERICAbooted @MSIntune I was far too vague with my comments. The signing works perfectly. When you try to use the scripts with MDE Live Response, the publisher is not trusted so they don't run. Maybe this is solvable by WDAC CI trusting the publisher OID.

[Joe Lane @jrodericklane]

@NathanMcNulty @xenappblog @UK_Daniel_Card @IAMERICAbooted @MSIntune Doesn’t the signing cert need to be in the trusted publishers store? If it ignored validity you would still need to add a new cert if you added another script more than 4 days later.

[Joe Lane @jrodericklane]

@NathanMcNulty @xenappblog @UK_Daniel_Card @IAMERICAbooted @MSIntune Yea you can’t use the public trust for scripts because the signing cert expires very quickly.

[INFOSEC F0X 🔥 @infosec_fox]

Dear algorithm, please lead me to my fellow cybersecurity professionals.

[Joe Lane @jrodericklane]

@davidbombal https://t.co/4fpbOh9PeG

[Joe Lane @jrodericklane]

@ITguySoCal How did you discover it was due to valid mfa claim?

[Joe Lane @jrodericklane]

@techspence @Collab_Seth Sadly I think this only makes sense to those who are familiar with that admin architecture.

[Joe Lane @jrodericklane]

@ellishlomo By other environments do you mean not MDE? Or do some environments have increased logging intervals for DeviceNetworkEvents?

[Joe Lane @jrodericklane]

@kj_ninja25 Is there any effort to address the fact that incident descriptions created in Sentinel are lost with this integration?

[Joe Lane @jrodericklane]

@ep3p Have you found any workarounds for incident descriptions?

[Joe Lane @jrodericklane]

@techspence Do you use something like nenv or poetry and still have problems?

[Joe Lane @jrodericklane]

@ep3p @kj_ninja25 Ouch you’re right. I see this happening to us now.

[Joe Lane @jrodericklane]

@ep3p @kj_ninja25 Why

[Joe Lane @jrodericklane]

@nas_bench @cyb3rops Was it not that he noticed an increase in cpu time and not an actual realtime 500ms delay?

[Joe Lane @jrodericklane]

@RoxCodes @ThePrimeagen Footmen frenzy

[Joe Lane @jrodericklane]

@miketheitguy I wish I could like this more than once.

[Joe Lane @jrodericklane]

@pvanderwoude Will this ever be available to Windows 10?

[Joe Lane @jrodericklane]

@el_nawser MDE scanning?

[Joe Lane @jrodericklane]

@MrPalmBeachTV @bstategames #FreeMrPalmBeach