News for hackers. Stuff that matters.

A comment on CrowdStrike ex-employees: 'Quality control was not part of our process'. Parent comment

Re:CrowdStrike ex-employees: 'Quality control was not part o... by meowface on Friday September 13, 2024 @07:27PM (#41536123)
All SIEM instances certainly contain a lot of sensitive data in events, but I'm not sure if most agents forward all environment variables to a SIEM.
[ Parent | on HN ]
Re:CrowdStrike ex-employees: 'Quality control was not part o... by hello_moto on Saturday September 14, 2024 @12:51AM (#41537543)
Agents don't just read env vars and send them to SIEM.

There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that any EDR software in this beautiful planet would have tracked.

[ Parent | on HN ]
Re:CrowdStrike ex-employees: 'Quality control was not part o... by st3fan on Saturday September 14, 2024 @07:35AM (#41539123)
No it logs every command macOS runs or that you type in a terminal. Either directly or indirectly. From macOS internal periodic tasks to you running “ls”.
[ Parent | on HN ]