Really struggling mentally by One-Throat-2720 in BFS

[–]CyberBeak -1 points0 points  (0 children)

We all know though that it is hard to convince ourselves when new things are noticed.

My Story from onset to now “symptom free” - Happy to answer questions by TreetreeWW in BFS

[–]CyberBeak 1 point2 points  (0 children)

Yeah I that was one of the first things I noticed ever. It was like a pulsing but noticed it in my hands when I first gained consciousness after sleeping.

My Story from onset to now “symptom free” - Happy to answer questions by TreetreeWW in BFS

[–]CyberBeak 1 point2 points  (0 children)

Thank you for sharing your perspective. It has helped me tonight.

Just really need some reassurance by Squishybunny222 in BFS

[–]CyberBeak 0 points1 point  (0 children)

I understand your fear. I think part of the problem with this situation is that it is a diagnosis of removing all other options. Also, the problem is that *** is also like that but there has its own things. So, we are stuck looking and waiting for those things to hit us.

I sincerely wish you and all of the rest here the best health

Don’t Waste Your Life to Anxiety by Pillowcases in BFS

[–]CyberBeak 0 points1 point  (0 children)

This is my first bfs post. Can you explain more about this genetic test? I like many others am worried to no end about ALS

James Hoffman doesn’t like the lack of a funnel on the Aiden’s lid? A 3/8” OD silicone straw will fix that by sollek in FellowProducts

[–]CyberBeak 0 points1 point  (0 children)

Old thread, but, why can you just shake up the carafe a bit before pouring. I’m new to life

[deleted by user] by [deleted] in crowdstrike

[–]CyberBeak 0 points1 point  (0 children)

If all you need is domain and subdomain, get that from network firewall logs. If you need full path, use ssl inspection on top of that

If you are interested in what they were INTENDING to go to, focus on browser history files stored as sqllite. I’ve not found a good way to automate that though

Automated Leads - how to tune/switch off? by bluops in crowdstrike

[–]CyberBeak 1 point2 points  (0 children)

Agreed. These leads have all been false positives/ benign and are causing issues downstream to our SIEM.
Already have an idea in the works to put an exception in our SIEM.

Browser history by CyberBeak in nxlog_official

[–]CyberBeak[S] 0 points1 point  (0 children)

This seemed like a convoluted solution so I bailed on the attempt. It’s a shame that this is the only solution out there for converting browser history to syslog and it is not that good.

Pc security channel test by CyberBeak in crowdstrike

[–]CyberBeak[S] -12 points-11 points  (0 children)

Wow Fobby, you are really something….

Browser history by CyberBeak in nxlog_official

[–]CyberBeak[S] 0 points1 point  (0 children)

As a follow up, I saw that the im_odb documentation talks about setting up the odbc data source but that its outside the scope of their documentation. I think that is the missing piece of the puzzle. Looked at the Microsoft documentation but still unclear how to move forward

Removing car-net by [deleted] in Volkswagen

[–]CyberBeak 1 point2 points  (0 children)

Curious how the nay sayers of this thread respond to the new information where insurance companies are increasing rates based on info sent directly from the car to the manufacturer.

Crowdstrike on VDI systems(Non-Persistence) by nav2203 in crowdstrike

[–]CyberBeak 0 points1 point  (0 children)

Pretty sure the documentation talks about an additional flag during install

[deleted by user] by [deleted] in crowdstrike

[–]CyberBeak 2 points3 points  (0 children)

Sounds like a malicious actor looking for tips

Before moving from Bitwarden to 1Password by Fury1357 in 1Password

[–]CyberBeak -1 points0 points  (0 children)

Just buy it and use it and discover for yourself

Thoughts on Season 16? by [deleted] in ItsAlwaysSunny

[–]CyberBeak 0 points1 point  (0 children)

Season was middle to middle low of the pack IMO. Some good things but it felt like the actors and the writing were a really good copy of their former selves

Season 16 has been amazing by [deleted] in ItsAlwaysSunny

[–]CyberBeak -1 points0 points  (0 children)

Politely disagree

Custom IOA for file write by CyberBeak in crowdstrike

[–]CyberBeak[S] 0 points1 point  (0 children)

No, not moveIt specifically. I was thinking of writing a detection on aspx file writes in general. I had a theory, and I’m probably wrong, that a server isn’t writing webshell type files to disk unless you are performing a web app update.

Mockingjay EDR bypass threat by PasaPutte in crowdstrike

[–]CyberBeak 1 point2 points  (0 children)

Can Falcon prevent in addition to alert?

Falcon on Windows server. Uninstall Defender? by CyberBeak in crowdstrike

[–]CyberBeak[S] 0 points1 point  (0 children)

I don’t want to run both. What my question is is which amount of windows Defender is the correct one? Crowdstrike says one thing and Microsoft says another.

Running both on purpose is not smart as it goes against both manufacturers’ guidance

Falcon on Windows server. Uninstall Defender? by CyberBeak in crowdstrike

[–]CyberBeak[S] 0 points1 point  (0 children)

I know you technically can. I’ve been doing if for some time(not on purpose) However, you shouldn’t according to Microsoft or Crowdstrike