Re:CrowdStrike ex-employees: 'Quality control was not part o...
by hello_moto on Saturday September 14, 2024 @12:51AM
(#41537543)
Agents don't just read env vars and send them to SIEM.
There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that any EDR software in this beautiful planet would have tracked.
Re:CrowdStrike ex-employees: 'Quality control was not part o...
by st3fan on Saturday September 14, 2024 @07:35AM
(#41539123)
No it logs every command macOS runs or that you type in a terminal. Either directly or indirectly. From macOS internal periodic tasks to you running “ls”.
There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that any EDR software in this beautiful planet would have tracked.