0x657 - Teknik - La guerre Red Team vs EDR : l’aspect business et non technique du problème

Value of the Information & Strength of the Argument

The value of the information lies in the expert’s practical insights into EDR evasion, drawn from years of red teaming experience. The argumentation is solid, as Hamilton supports his claims with concrete examples, such as the Broadcom-acquired EDR losing Microsoft signing, the effectiveness of simple modifications to known tools, and the persistence of old techniques due to EDRs’ focus on commodity malware. He also argues that the cybersecurity industry is business-driven, which influences product development and detection capabilities. The reasoning is coherent and well-structured, moving from technical explanations to strategic recommendations.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the content is based on expert opinion and anecdotal evidence rather than formal research. The quality of sources is limited, as no specific references are cited, though the discussion references known tools and techniques like Cobalt Strike, Sysmon, and CrowdStrike incidents. The title accurately reflects the content, focusing on the business and non-technical aspects, though the technical discussion is also substantial. No comments were provided for analysis.

The title accurately reflects the content, focusing on the business and non-technical aspects of the Red Team vs EDR conflict, though the discussion also covers technical details.

8/10

The content is based on the expert's extensive field experience in red teaming and EDR evasion. The discussion is practical and grounded, with concrete examples and technical details. However, it is an opinion-based podcast without formal citations or peer-reviewed sources, and some claims are anecdotal.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction to the podcast and the topic of Red Team vs EDR.
• 05:00Discussion on the business nature of cybersecurity and EDR vendors.
• 10:00Explanation of EDR components: static analysis, user-mode hooking, kernel callbacks, ETW.
• 15:00Mention of PPL (Protected Process Light) and its implications.
• 20:00Discussion on evasion techniques, including modifying PinkCastle and disabling EDR network connectivity.
• 30:00Example of a 'new' backdoor being old code, illustrating the gap between detection and existence.
• 40:00Recommendations: importance of human analysis, Sysmon deployment, and network visibility.
• 50:00Discussion on the lack of Blue/Red team collaboration and the need for internal intelligence.

• Cobalt Strike — Mentioned as a framework with built-in features for process injection and evasion.
• Sysmon — Recommended as a tool for enhanced visibility and log collection.
• CrowdStrike Incident — Referenced as an example of a kernel-level error causing blue screens.

• MITRE ATT&CK — Provides a framework for understanding attacker techniques, which aligns with the discussion on evasion.

• Vendor Claims on EDR Effectiveness — The podcast argues that EDR vendors often overstate their capabilities, which contrasts with marketing claims.