Since this thread is on product reviews, I would like remind readers that there is No Such Thing as 100% perfect security. Technical defenses, which include firewalls, AV's, IPS etc can all be defeated given enough time and effort. And hackers have that advantage.
And then, take into consideration that this is a white box test - my red team ( and the guest ) knows exactly what defenses I have. And they correctly chose a Network based attack, without using any malware which would be virtualized by Xcitium OpenEDR.
An important defense layer is having backups. This is your last layer of defense. One must always have backups. And this attack on logonui is the perfect example, I can not login.
The solution is restore from image backup, and then vritualizing logonui.exe in Xcitium's Auto Containment Rules. The solution was simple, figured it out and completed in 20 mins.
The guest hacker then attacked again, and this time, the attack failed.
For those readers who are new, the red team and I play this game constantly. The aim is to find the holes in our security and then fix them, in preparation for the Real Thing.
I am adding this post to illustrate that Xcitium OpenEDR is configurable, and can be adapted to defend against new attacks. Xcitium OpenEDR s a nice tool. Other AV's defenses cannot be configured. The AV would let you choose what to scan, what to exclude etc, but you cannot add new definitions to it. You have to wait till the vendor adds a capabiltiy, so, in the mean time, when you are under attack, what do you do?
