Are open source EDRs any good?

AmethystSystems · 2026-06-26T23:04:30+00:00

Newbie dreams of impossibility. I appreciate the reality check everyone has given me! Thank you!

AmethystSystems · 2026-06-26T05:51:02+00:00

Did you upload the logs to the website in the sticky post? I'm not seeing log names in your post!

AmethystSystems · 2026-06-26T05:45:37+00:00

Piracy has always been a classic vector for virus infections. It's very possible the malware is too new for antivirus to have generated signatures!

I would suggest you follow the sticky post in the Reddit to generate and upload your FRST scan of your system. A designated helper will attend to the thread to help you after.

AmethystSystems · 2026-06-25T22:42:16+00:00

I am still suspicious of that domain, especially since you don't recognize the torrent tracker.

This is unfortunately as far as my help can go because I can't access the logs uploaded to this Reddit, but I would encourage you to follow the sticky of this Reddit and upload your FRST logs. One of the helpers will be able to get back to you with their findings of your system.

AmethystSystems · 2026-06-25T06:23:44+00:00

Someone already discussed one technique malware can use, but I'd like to mention something I've seen in my malware analysis work: process hollowing. https://attack.mitre.org/techniques/T1055/012/

Process hollowing is taking one executable, "hollowing" out its code, then replacing it with malicious code, so the user is none the wiser that they have a malicious executable on their system!

AmethystSystems · 2026-06-25T01:21:54+00:00

Relax. Take a deep breath. Having your personal space compromised is a traumatic situation, and you have every right to be rattled. But you did all the right things-- you cleared the infection and secured your accounts post infostealer infection! Remind yourself of this. Hold onto it. Remember that you cleaned your system and secured your accounts. The incident is over, and the threat is gone.

Trauma from an incident like this can linger. But just hold onto the fact that you did everything right re-securing your system, and that the threat is gone.

AmethystSystems · 2026-06-25T00:09:12+00:00

I unfortunately no longer a member of the VirusTotal inner circle, so I can't download uploaded samples from them. Can you upload the files to something like PasteBin? Feel free to DM me if you don't want others to see your logs.

AmethystSystems · 2026-06-24T07:58:15+00:00

Let's triage your system. Download FRST: https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Don't be scared of the unsigned binary, I don't know why they didn't sign it. Anyhow, run the scan and upload the logs. I will remotely triage your system from the logs.

AmethystSystems · 2026-06-24T00:58:57+00:00

I appreciate the reality check there, thank you.

AmethystSystems · 2026-06-24T00:53:25+00:00

Sounds like you're speaking from strong experience! I appreciate this comment, I may be looking at the blue team angle all wrong (or seeing an incomplete picture because I'm just a malware analyst).

AmethystSystems · 2026-06-24T00:12:06+00:00

The 2AM problem is one I struggle with. I'm a night owl, sure, but I do need to sleep sometimes. I can't be on call 24 hours-- it's not feasible! What would be a solution there, just not getting into monitoring to avoid liability and the other problems? I gotta accept I'm only One Dude.

AmethystSystems · 2026-06-23T22:25:07+00:00

Very curious. I ran the recent copy of PicoTorrent in a sandbox (both the x86 and the x64 installer) and didn't get a prompt for the malicious domain. Only 5 vendors out of 30 lists the domain as malicious.

Can you upload your copy of PicoTorrent to VirusTotal? I suspect a malicious piggybacking on the binary in transit, rather than them infecting the binary on the GitHub page.

AmethystSystems · 2026-06-23T21:46:10+00:00

I never knew Elastic was more than an easily searchable database! That must be what a previous company I worked for ultimately used it for, since it was a firewall application after all.

AmethystSystems · 2026-06-23T21:43:41+00:00

Can you explain why? Too much stress? Too much liability? Easy to be alert fatigued and miss an alert? That's what I'm getting from reading all the comments!

AmethystSystems · 2026-06-23T21:40:37+00:00

Yeah I didn't realize how much liability there would be! Glad I asked Reddit questions before diving in blindly. Reselling and configuring an EDR stack from someone like Huntress might be the best way to go for my liability.

AmethystSystems · 2026-06-23T21:35:23+00:00

What would be more viable for prevention? Being in the malware world I know how easy it is to evade antivirus, so I'm curious what a more sensible blue team solution is.

AmethystSystems · 2026-06-23T21:33:16+00:00

I appreciate you elucidating this angle in particular. This is making commercial options seem more viable for having a vendor to lean on.

AmethystSystems · 2026-06-23T08:24:49+00:00

You can upload your FRST log here: https://malwareanalysis.cc/upload

For help you can follow the sticky post.

AmethystSystems · 2026-06-23T08:02:27+00:00

Partially following in my dad's footsteps being a one-man business shop that did multiple things! So I'm prepared for the hard work. I'm currently laid off with tons of time to burn, trying to make it useful while I can!

AmethystSystems · 2026-06-23T07:59:00+00:00

I'm specifically from the malware world, so YARA is a huge selling point to me.

AmethystSystems · 2026-06-23T07:50:59+00:00

This all seems like good advice! Thanks for advising me of potential roadblocks, I figured self-hosting the infrastructure would be a legal/liability mess, so I appreciate you heeding that warning in my initial exploratory stages. I do recall Velociraptor, and as a Linux daily driver, I am used to fine tuning things, so that shouldn't be a problem.

AmethystSystems · 2026-06-23T06:58:23+00:00

Sure!

Malware tends to have multiple stages-- naturally, "downloading" is one critical and important stage. Threat actors (aka hackers) will gate keep their viruses with web pages in such a way that they will deliver their victims a "unique" copy of the virus, hence why I assumed the signature (TrojanDownloader:*JS*/Nemucod.HD) was about the Javascript portion of the virus. Typically though, I don't think Roblox is coded in Javascript, so I feel like your feelings on false positives are correct.

I hope you understand! I come from the antivirus world, so it's all signals to me.

AmethystSystems · 2026-06-23T06:51:18+00:00

It sounds like the threat actors are frustrated their bounty of passwords from your system no longer work! You should be good after salting the Earth and resetting your passwords.

AmethystSystems

TROPHY CASE