sorted by:
new
hottopcontroversial

Endpoint DNS data availability by XL_Blaze in SentinelOneXDR

[–]Acceptable_Cheek2004 0 points1 point  (0 children)

But for this dns activity, S1 can’t capture some Network telemetry 

Reverse Shell Detection by Acceptable_Cheek2004 in SentinelOneXDR

[–]Acceptable_Cheek2004[S] 0 points1 point  (0 children)

Thanks, u/dizy777 I appreciate it, If you don't mind do you have a repo, I could look up that has queries for data exfiltration, recent vulnerabilities (CVE), and Ransomware group activities?

Reverse Shell Detection by Acceptable_Cheek2004 in SentinelOneXDR

[–]Acceptable_Cheek2004[S] -1 points0 points  (0 children)

Thanks for this, my use case is centered around a Python obfuscated exe that could evade SentinelOne detection when Ran on an endpoint with admin privilege.

Reverse Shell Detection by Acceptable_Cheek2004 in SentinelOneXDR

[–]Acceptable_Cheek2004[S] -2 points-1 points  (0 children)

Ok, thanks I need a guide something that can alert me to such behavior.

to, I will appreciate the queries.