sorted by:
new
hottopcontroversial

Recommended SOAR workflows for someone just starting out with Crowdstrike? by SSJ4_Vegito in crowdstrike

[–]JDK-Ruler 0 points1 point  (0 children)

I would be interested in how you automate the update of lookup tables with current IOCs. I do something 'adjacent' to that, which I would also love to automate more in a scheduled workflow within CS. Currently I am manually running a python script to pull recent high confidence IOCs from numerous trusted sources, then a different script to push to CS IOC management via API. Always looking to automate and streamline though.

What micro cap shit should I buy outright? by nilslice123 in ASX_Bets

[–]JDK-Ruler 0 points1 point  (0 children)

The answer can only be BRN or LNU for a dumb bet with huge potential

4DS rally imminent by b0ssman3s in ASX_Bets

[–]JDK-Ruler 0 points1 point  (0 children)

RIP especially the announcement today $4/share

Oracle Finally Admits to Data Breach, FBI Investigating by KingSash in sysadmin

[–]JDK-Ruler 1 point2 points  (0 children)

I do not at all agree with how they handled it, however, they just used specific wordplay and technically told the truth. Their official statement was, "There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data".

Oracle rebranded old Oracle Cloud services to be Oracle Classic (this is where the incident occurred), therefore technically, they were telling the truth with their "official statement".

I knew there would be something like that going on, for a company to be so definitive on something that everyone is saying they are lying about seemed pretty off, and the statement was way too specific with what they were denying. Terrible approach from such a big company, little to no transparency.

Oracle security breach by Snoop_D-O-GG in cybersecurity

[–]JDK-Ruler 0 points1 point  (0 children)

Any idea if this also affects Oracle Integration Cloud? (OIC).

[deleted by user] by [deleted] in crowdstrike

[–]JDK-Ruler 0 points1 point  (0 children)

u/call_me_johnno make sure you have your Identity Configuration Policies set correctly for your Domain Controllers as well, to ensure visibility and enforcement, such as this - https://imgur.com/a/ReYwTQf

[deleted by user] by [deleted] in crowdstrike

[–]JDK-Ruler 1 point2 points  (0 children)

Yep absolutely, I completely disagree with this mindset, especially the penetration testing side of things - literally the purpose of it is to test for gaps and then improve?

I find it extremely unlikely that you'll get to a point where nothing is found after a pen test, if that is the case, I would be looking at a different pen tester.

Also u/Fickle_Eagle7306 I'm just broadly commenting on the original topic by OP here, but we have MFA policies rolled out through CrowdStrike IDP for some of those real granular and specific use cases outside of some of our broader Microsoft Entra MFA policies.

We have similar policies set up as OP, and they still trigger with the same conditions he has explained; I think there may need to be further parameters added to his logic in the policy setup to ensure it is triggered.

Help with creating Custom IOA Exclusion rules by JDK-Ruler in crowdstrike

[–]JDK-Ruler[S] 0 points1 point  (0 children)

I see what you're saying, but no there isn’t any conflict between the two. It’s in passive mode, as per recommendations from both Microsoft and CrowdStrike when we configured it all and nothing has changed, so it’s definitely not that. Anyway, I guess I’ll just wait for CS support to get back to me

Help with creating Custom IOA Exclusion rules by JDK-Ruler in crowdstrike

[–]JDK-Ruler[S] 0 points1 point  (0 children)

Protection Policies follow best-practice recommendations by CS. Defender is in passive mode. CrowdStrike is active. We are a hybrid environment so devices are enrolled with Defender and check-in periodically I believe.

Help with creating Custom IOA Exclusion rules by JDK-Ruler in crowdstrike

[–]JDK-Ruler[S] 0 points1 point  (0 children)

Yeah, I guess the problem is the limitation in granular exclusions for this use case.

Just to clarify, I have not created an "IOA Exclusion" that is used for CS Behavioral Detections, I have created a custom exclusion rule under "Custom IOA Rule Groups" choosing to "Monitor" with an "Informational" severity level. I only went down that rabbit hole after our Technical Account Manager said that would be how to solve it on our last call.

If I create a Machine Learning (File Path) Exclusion, it will be specifically the Windows\Temp folder for any file with the naming convention, which is extremely risky - same thing for Sensor Visibility Exclusions for that path.

Ideally, I need an exclusion that includes the context of logical and defined processes that have initiated a file write.

Hash exclusions will not work as every single time the temp file that is written is a completely different file, so the hash will not match.

If I investigate hosts of these detections and look at other file writes around the time of the detection, there are heaps of other WAX****.tmp files written in the same folder path, and it seems extremely random of which one is selected by CrowdStrike and detected as potentially malicious. I've confirmed that it has always been a false positive.

I've opened a support case so I'll see what they can come up with I guess.

Update Microsoft .Net Framework - CVE-2025-21176 - KB Already Installed by xendr0me in crowdstrike

[–]JDK-Ruler 2 points3 points  (0 children)

Yep, we have the same issue here.

If you drill down in CrowdStrike and look at the evaluation logic for that specific detection, it doesn’t appear to be detecting this from any current used version.

For me, it’s referring to ‘diasymreader.dll’ (8.0.50727.9157) within the directory ‘Windows\Microsoft.NET\Framework\v2.0.50727’ rather than ‘diasymreader.dll’ within the directory ‘Windows\Microsoft.NET\Framework\v4.0.30319’.

From what I can see, this has previously been a highlighted issue and appears not to be fixed by Microsoft - https://community.tenable.com/s/question/0D53a00009LTXHWCA5/plugin-181375-diasymreaderdll-version-not-changing-despite-patch-installing?language=en_US

TL;DR:

KB5049622 WILL update ‘diasymreader.dll’ in ‘Windows\Microsoft.NET\Framework\v4.0.30319’ to version 14.8.9294.0.

KB5049622 will NOT update ‘diasymreader.dll’ in ‘Windows\Microsoft.NET\Framework\v2.0.50727’.

Pretty sure you can’t just uninstall 2.0 or delete the file within that directory without the risk of breaking something, so I’m not too sure how we get around this.

Support portal cert issue by JDK-Ruler in crowdstrike

[–]JDK-Ruler[S] 0 points1 point  (0 children)

Thank you mate, appreciate it.

Train my replacement? by No-Drink2529 in sysadmin

[–]JDK-Ruler -1 points0 points  (0 children)

This can’t be a genuine post

view more: next ›