Master of Puppets: How to Tamper an EDR?

SANS PenTest HackFest 2022

Speaker: Daniel Feichter, Founder, Infosec Tirol

More and more companies realize, trying to prevent malicious activities alone is not enough, therefore more and more companies are using EDR products in their environment. From red team perspective this gets more and more a challenge, because even if the red team has achieved a local privilege escalation, most well known EDR products are still be very annoying. In the last few months we saw a lot about bypassing …

challenge companies daniel edr environment escalation founder hackfest infosec local local privilege escalation malicious master pentest perspective privilege privilege escalation products red team sans team