Advice Request A blueprint for evading industry leading endpoint protection in 2022

[[correlate]]

About two years ago I quit being a full-time red team operator. However, it still is a field of expertise that stays very close to my heart. A few weeks ago, I was looking for a new side project and decided to pick up an old red teaming hobby of mine: bypassing/evading endpoint protection solutions.

In this post, I’d like to lay out a collection of techniques that together can be used to bypassed industry leading enterprise endpoint protection solutions. This is purely for educational purposes for (ethical) red teamers and alike, so I’ve decided not to publicly release the source code. The aim for this post is to be accessible to a wide audience in the security industry, but not to drill down to the nitty gritty details of every technique. Instead, I will refer to writeups of others that deep dive better than I can.

A blueprint for evading industry leading endpoint protection in 2022

Bypassing CrowdStrike and Microsoft Defender for Endpoint

vanmieghem.io

 

[Trooper]

Nice. Thanks for sharing this.

 

[[correlate]]

Nice. Thanks for sharing this.

It is good to share such news.
I don't like these programs to fail, especially the CrowdStrike Falcon
It's a great protection program that I hope to try one day.

 

[Trooper]

It is good to share such news.
I don't like these programs to fail, especially the CrowdStrike Falcon
It's a great protection program that I hope to try one day.

Agreed. I want to try CrowdStrike Falcon as well. I wish they had a home version available. I may test next summer at my job to decide if we keep what we use currently.

Cheers!

 

[SpiderWeb]

Agreed. I want to try CrowdStrike Falcon as well. I wish they had a home version available. I may test next summer at my job to decide if we keep what we use currently.

Cheers!

Same. Crowdstrike Home Edition would be an instant buy for me.