Infosec Practitioner
Recently, SentinelOne had a blog post about how Lockbit Ransomware was using Windows Defender to side load Cobalt Strike. Considering that this technique I sat down to write up a query(that is available at my Github here) for a custom detection of this procedure based off the information in the SentinelOne Blog post. Here I…
I’ve had some things on my mind so this will turn into a rant or stream of consciousness. If you feel called out on this post, it happens. Hopefully this will help some others out there. See, I’ve spent the last 15 years, as I moved from a Network Engineer to a Security Engineer, trying…
Recently, I have been wondering why a site such as mail[.]ru(and it’s subdomains) is being blocked by Microsoft Exploit Guard’s Network Protection setting and not Umbrella. Considering that Network Protection does not give an actual block page, and instead a generic access denied page, it seems that the order of things were to blame. I…
We use cookies to improve your experience on our site. By using our site, you consent to cookies.
Manage your cookie preferences below:
Essential cookies enable basic functions and are necessary for the proper function of the website.