0x692 - Teknik - La guerre Red Team vs EDR :part 2

Value of the Information & Strength of the Argument

The value of the information is high for cybersecurity professionals, especially those in red teaming or defensive roles. The guest provides practical, actionable techniques that are not widely known, such as using named pipes to evade detection and the importance of randomness in obfuscation. The argumentation is solid, grounded in real-world experience and examples, such as the ‘EDR Freeze’ technique. The discussion is coherent and logically structured, moving from specific evasion techniques to broader defensive strategies. The claims are plausible and align with common knowledge in the field, though some are anecdotal and not formally verified.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the discussion is based on expert opinion and practical experience rather than formal research. The sources are not explicitly cited, but the guest references known tools and techniques like Cobalt Strike and Mimikatz. The title accurately reflects the content, which is a technical discussion on red team vs EDR techniques. The content is well-structured and provides valuable insights, but it lacks formal citations and empirical evidence. The adequacy between title and content is good, as the episode indeed covers the ongoing battle between red teams and EDRs.

The title accurately reflects the content, which is a technical discussion on red team vs EDR techniques, part 2.

8/10

The discussion is based on the expert's practical experience in red teaming and EDR evasion, with concrete examples and references to known techniques. The claims are plausible and align with common knowledge in the field, though not all are formally verified.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction and overview of the episode's focus on EDR evasion techniques.
• 05:00Discussion on the limitations of EDRs and the use of named pipes to bypass detection.
• 10:00Explanation of obfuscation techniques, including randomness in variable names and sizes.
• 15:00Importance of memory cleaning and avoiding artifacts in memory.
• 20:00Discussion on kernel-level protections and techniques like EDR Freeze.
• 25:00Challenges of cloud security and the lack of visibility in cloud environments.
• 30:00Defensive recommendations, including blocking PowerShell and disabling unnecessary tools.
• 35:00The role of human analysts in threat hunting and contextualizing alerts.
• 40:00Conclusion and final thoughts on the state of EDRs and security practices.

• Cobalt Strike — Mentioned as an example of a tool that leaves artifacts in memory.
• Mimikatz — Referenced as a tool that can be blocked by PPL protections.
• YARA rules — Mentioned in the context of detection patterns for obfuscated code.

• MITRE ATT&CK — Provides a framework for understanding attacker techniques, including those discussed in the episode.
• SANS Institute — Offers training and research on cybersecurity, including EDR evasion and threat hunting.

• EDR vendor claims — The episode challenges the marketing claims of EDR vendors that they are not signature-based, arguing that they still rely on signatures and behavioral patterns.