Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1067633" data-attributes="member: 96560">If you are evaluating Xcitium / OpenEDR, pay close attention to Web Console: Dashboard &gt; Service &gt; Endpoint &gt; click on Total Alerts number. The alerts are Really Good. They give a process verdict, the execution tree, and a techniqueID which is a googleable reference number to Mitre Att&amp;ck; saying why the Alert is suspicious.So far, I have tested BitDefender EDR and Kaspersky EDR Optimum.BitDefender EDR does not seem to detect or stop network attacks. I gave up on them. There&#039;s a reason why they did not participate in AV-Comparatives APT tests.. However to be fair to BitDEfender, it, like OpenEDR, does not notice any network attacks. But OpenEDR has Auto Containment, which virtualizes any suspiciously invoked exe ( native to Windows or not ). And that is what gives OpenEDR the advantage. BitDefender&#039;s saving grace is that it&#039;s process trace diagram gives a lot of detail, and lists any&nbsp; registry keys that was modified. However, it&#039;s default alert rules are close to non-existant, you have to specify a search term to define a Alert rule, and then it will show you the process trace diagram. I only had 3 alert rules defined: powershell, cmd, and a LoL Bin favorite of my red team. And BitDefender then displayed the possible attack, although it did not indicate a network attack is in progress, you Will notice that, for example, powershell does not have that process tree when you normally start it,&nbsp; and that invocation of powershell is some funny business.Kaspersky EDR stops some network attacks by my red team. But does not report them. Even when I especially made a Application Control &gt; Block rule to block execution of a LoL Bin, it only pops up a notification on the client PC, and Does Not raise an Alert on the web cosole. So if you missed the notification, there is No Trace of the attack. And Kaspesky EDR Optimum does not have an Investigation console panel, so you can&#039;t search for past events. Sad.The sole remediation action of BitDefender EDR and Kaspsersky EDR Optimum is the same: block it. However, note it is not possible to block common Windows tools, because you will be locking out all users&#039; invocation of the tool.</blockquote>

[QUOTE="Victor M, post: 1067633, member: 96560"] If you are evaluating Xcitium / OpenEDR, pay close attention to Web Console: Dashboard > Service > Endpoint > click on Total Alerts number. The alerts are Really Good. They give a process verdict, the execution tree, and a techniqueID which is a googleable reference number to Mitre Att&ck; saying why the Alert is suspicious. So far, I have tested BitDefender EDR and Kaspersky EDR Optimum. BitDefender EDR does not seem to detect or stop network attacks. I gave up on them. There's a reason why they did not participate in AV-Comparatives APT tests.. However to be fair to BitDEfender, it, like OpenEDR, does not notice any network attacks. But OpenEDR has Auto Containment, which virtualizes any suspiciously invoked exe ( native to Windows or not ). And that is what gives OpenEDR the advantage. BitDefender's saving grace is that it's process trace diagram gives a lot of detail, and lists any registry keys that was modified. However, it's default alert rules are close to non-existant, you have to specify a search term to define a Alert rule, and then it will show you the process trace diagram. I only had 3 alert rules defined: powershell, cmd, and a LoL Bin favorite of my red team. And BitDefender then displayed the possible attack, although it did not indicate a network attack is in progress, you Will notice that, for example, powershell does not have that process tree when you normally start it, and that invocation of powershell is some funny business. Kaspersky EDR stops some network attacks by my red team. But does not report them. Even when I especially made a Application Control > Block rule to block execution of a LoL Bin, it only pops up a notification on the client PC, and Does Not raise an Alert on the web cosole. So if you missed the notification, there is No Trace of the attack. And Kaspesky EDR Optimum does not have an Investigation console panel, so you can't search for past events. Sad. The sole remediation action of BitDefender EDR and Kaspsersky EDR Optimum is the same: block it. However, note it is not possible to block common Windows tools, because you will be locking out all users' invocation of the tool. [/QUOTE]

Verification