{"version":"1.0.0","segments":[{"speaker":"Spencer","startTime":6.51,"endTime":9.75,"body":"Tyler and I have done"},{"speaker":"Spencer","startTime":6.51,"endTime":9.75,"body":"1000s of hours of internal pen"},{"speaker":"Spencer","startTime":9.84,"endTime":14.55,"body":"tests over the last couple"},{"speaker":"Spencer","startTime":9.84,"endTime":14.55,"body":"years. I mean, combined, you"},{"speaker":"Spencer","startTime":14.58,"endTime":18.06,"body":"know, just me alone in 2025, I"},{"speaker":"Spencer","startTime":14.58,"endTime":18.06,"body":"have 1000. Tyler, you have"},{"speaker":"Spencer","startTime":18.12,"endTime":21.02,"body":"probably close to that as well."},{"speaker":"Spencer","startTime":18.12,"endTime":21.02,"body":"So over the last five years or"},{"speaker":"Spencer","startTime":21.08,"endTime":24.35,"body":"so are doing this. Tyler and I"},{"speaker":"Spencer","startTime":21.08,"endTime":24.35,"body":"have pen tested hundreds of"},{"speaker":"Spencer","startTime":24.41,"endTime":28.58,"body":"organizations and 1000s of hours"},{"speaker":"Spencer","startTime":24.41,"endTime":28.58,"body":"of internal pen tests. We have"},{"speaker":"Spencer","startTime":28.67,"endTime":32.21,"body":"seen clients across all"},{"speaker":"Spencer","startTime":28.67,"endTime":32.21,"body":"different industries: financial"},{"speaker":"Spencer","startTime":32.27,"endTime":37.01,"body":"services, manufacturing,"},{"speaker":"Spencer","startTime":32.27,"endTime":37.01,"body":"healthcare, universities,"},{"speaker":"Spencer","startTime":37.16,"endTime":42.43,"body":"municipalities, like you name"},{"speaker":"Spencer","startTime":37.16,"endTime":42.43,"body":"it, and of all sizes, and one of"},{"speaker":"Spencer","startTime":42.49,"endTime":47.86,"body":"the most common failures we see"},{"speaker":"Spencer","startTime":42.49,"endTime":47.86,"body":"is lack of detections or just"},{"speaker":"Spencer","startTime":47.95,"endTime":52.0,"body":"poor security monitoring threat"},{"speaker":"Spencer","startTime":47.95,"endTime":52.0,"body":"detection. So in this episode,"},{"speaker":"Spencer","startTime":52.03,"endTime":55.6,"body":"we're going to talk about"},{"speaker":"Spencer","startTime":52.03,"endTime":55.6,"body":"CrowdStrike specifically and"},{"speaker":"Spencer","startTime":55.72,"endTime":59.62,"body":"some of the very critical,"},{"speaker":"Spencer","startTime":55.72,"endTime":59.62,"body":"crucial settings that we think"},{"speaker":"Spencer","startTime":59.8,"endTime":64.68,"body":"need to be enabled, that"},{"speaker":"Spencer","startTime":59.8,"endTime":64.68,"body":"directly have impact on your"},{"speaker":"Spencer","startTime":65.04,"endTime":68.85,"body":"ability to detect malicious"},{"speaker":"Spencer","startTime":65.04,"endTime":68.85,"body":"stuff, suspicious stuff on your"},{"speaker":"Spencer","startTime":68.91,"endTime":72.36,"body":"endpoints. But they're also"},{"speaker":"Spencer","startTime":68.91,"endTime":72.36,"body":"really important for the"},{"speaker":"Spencer","startTime":72.39,"endTime":75.69,"body":"telemetry that you gather and"},{"speaker":"Spencer","startTime":72.39,"endTime":75.69,"body":"are able to get once you turn"},{"speaker":"Spencer","startTime":75.72,"endTime":79.14,"body":"those settings on. So I think it"},{"speaker":"Spencer","startTime":75.72,"endTime":79.14,"body":"makes sense to start out with"},{"speaker":"Spencer","startTime":79.2,"endTime":83.0,"body":"stories, story time on this"},{"speaker":"Spencer","startTime":79.2,"endTime":83.0,"body":"because we're going to talk"},{"speaker":"Spencer","startTime":83.03,"endTime":86.45,"body":"about EDR and threat detection"},{"speaker":"Spencer","startTime":83.03,"endTime":86.45,"body":"and evasion and all these kinds"},{"speaker":"Spencer","startTime":86.48,"endTime":90.86,"body":"of things in this episode. But"},{"speaker":"Spencer","startTime":86.48,"endTime":90.86,"body":"we see this all the time, so it"},{"speaker":"Spencer","startTime":90.86,"endTime":94.37,"body":"makes make sense to share some"},{"speaker":"Spencer","startTime":90.86,"endTime":94.37,"body":"stories of why why this came"},{"speaker":"Spencer","startTime":94.46,"endTime":97.64,"body":"about and why we're so"},{"speaker":"Spencer","startTime":94.46,"endTime":97.64,"body":"passionate about it. So Tyler,"},{"speaker":"Spencer","startTime":97.67,"endTime":100.4,"body":"why don't you share a little bit"},{"speaker":"Spencer","startTime":97.67,"endTime":100.4,"body":"of background story on that, and"},{"speaker":"Spencer","startTime":100.43,"endTime":101.8,"body":"then I'll fill in any blanks."},{"speaker":"Tyler","startTime":102.82,"endTime":105.94,"body":"Yeah, to kind of open"},{"speaker":"Tyler","startTime":102.82,"endTime":105.94,"body":"Spencer and I, anytime we do"},{"speaker":"Tyler","startTime":106.03,"endTime":110.08,"body":"engagements, we have a section"},{"speaker":"Tyler","startTime":106.03,"endTime":110.08,"body":"within a platform that we use"},{"speaker":"Tyler","startTime":110.14,"endTime":113.71,"body":"for note taking called Nucleo,"},{"speaker":"Tyler","startTime":110.14,"endTime":113.71,"body":"and we'll keep notes on what's"},{"speaker":"Tyler","startTime":113.77,"endTime":117.13,"body":"detected, what's not detected by"},{"speaker":"Tyler","startTime":113.77,"endTime":117.13,"body":"an EDR that we're going against."},{"speaker":"Tyler","startTime":117.94,"endTime":120.93,"body":"And week after week, that makes"},{"speaker":"Tyler","startTime":117.94,"endTime":120.93,"body":"it easier for us to check our"},{"speaker":"Tyler","startTime":120.96,"endTime":124.05,"body":"notes and see. Okay, this"},{"speaker":"Tyler","startTime":120.96,"endTime":124.05,"body":"technique still working, or this"},{"speaker":"Tyler","startTime":124.17,"endTime":128.76,"body":"one needs to be improved. But we"},{"speaker":"Tyler","startTime":124.17,"endTime":128.76,"body":"also collaborate in messages,"},{"speaker":"Tyler","startTime":129.87,"endTime":132.51,"body":"and there'll be some weeks I'm"},{"speaker":"Tyler","startTime":129.87,"endTime":132.51,"body":"doing a pen test, and I am"},{"speaker":"Tyler","startTime":132.6,"endTime":136.23,"body":"getting zero headway. I'm"},{"speaker":"Tyler","startTime":132.6,"endTime":136.23,"body":"getting blocked everywhere."},{"speaker":"Tyler","startTime":136.62,"endTime":140.42,"body":"Every Amzy bypass is getting"},{"speaker":"Tyler","startTime":136.62,"endTime":140.42,"body":"blocked. None of the tooling I"},{"speaker":"Tyler","startTime":140.48,"endTime":143.39,"body":"have is working. There are"},{"speaker":"Tyler","startTime":140.48,"endTime":143.39,"body":"detections left, right, and"},{"speaker":"Tyler","startTime":143.54,"endTime":147.8,"body":"center for me. And then Spencer"},{"speaker":"Tyler","startTime":143.54,"endTime":147.8,"body":"is also running against"},{"speaker":"Tyler","startTime":147.83,"endTime":151.28,"body":"CrowdStrike, and he'll be like,"},{"speaker":"Tyler","startTime":147.83,"endTime":151.28,"body":"\"My client hasn't seen anything"},{"speaker":"Tyler","startTime":151.37,"endTime":155.99,"body":"this week so far. And so that"},{"speaker":"Tyler","startTime":151.37,"endTime":155.99,"body":"kind of got us thinking: Why are"},{"speaker":"Tyler","startTime":156.05,"endTime":159.05,"body":"there so many differences even"},{"speaker":"Tyler","startTime":156.05,"endTime":159.05,"body":"within the same product?"},{"speaker":"Spencer","startTime":160.49,"endTime":163.57,"body":"Yeah, and it's funny"},{"speaker":"Spencer","startTime":160.49,"endTime":163.57,"body":"because there's a couple reasons"},{"speaker":"Spencer","startTime":163.63,"endTime":167.23,"body":"for that, right? And one reason"},{"speaker":"Spencer","startTime":163.63,"endTime":167.23,"body":"is that the client doesn't know"},{"speaker":"Spencer","startTime":167.38,"endTime":171.34,"body":"where to go in the EDR to see"},{"speaker":"Spencer","startTime":167.38,"endTime":171.34,"body":"those alerts and to see the"},{"speaker":"Spencer","startTime":171.46,"endTime":173.68,"body":"activity that's happening, and"},{"speaker":"Spencer","startTime":171.46,"endTime":173.68,"body":"that's very common. That's"},{"speaker":"Spencer","startTime":173.68,"endTime":175.84,"body":"something that we see in purple"},{"speaker":"Spencer","startTime":173.68,"endTime":175.84,"body":"team engagements all the time."},{"speaker":"Spencer","startTime":176.71,"endTime":179.95,"body":"Is we'll start going through the"},{"speaker":"Spencer","startTime":176.71,"endTime":179.95,"body":"you know the techniques, and the"},{"speaker":"Spencer","startTime":180.01,"endTime":183.78,"body":"client won't necessarily know"},{"speaker":"Spencer","startTime":180.01,"endTime":183.78,"body":"where to go to look, and it's"},{"speaker":"Spencer","startTime":184.29,"endTime":187.8,"body":"part of that engagement is an"},{"speaker":"Spencer","startTime":184.29,"endTime":187.8,"body":"education training process for"},{"speaker":"Spencer","startTime":187.86,"endTime":191.61,"body":"them to learn where to go and"},{"speaker":"Spencer","startTime":187.86,"endTime":191.61,"body":"what to look for. But the other"},{"speaker":"Spencer","startTime":191.82,"endTime":195.54,"body":"side of the coin is the"},{"speaker":"Spencer","startTime":191.82,"endTime":195.54,"body":"telemetry is just not there, and"},{"speaker":"Spencer","startTime":195.57,"endTime":199.92,"body":"that's a very real possibility."},{"speaker":"Spencer","startTime":195.57,"endTime":199.92,"body":"And we run into this a lot of"},{"speaker":"Spencer","startTime":199.98,"endTime":204.23,"body":"times where I will run an AMZ"},{"speaker":"Spencer","startTime":199.98,"endTime":204.23,"body":"bypass that we know is getting"},{"speaker":"Spencer","startTime":204.26,"endTime":207.74,"body":"detected by CrowdStrike, and I"},{"speaker":"Spencer","startTime":204.26,"endTime":207.74,"body":"will run it on an engagement,"},{"speaker":"Spencer","startTime":207.92,"endTime":212.33,"body":"and it'll work fine, and no"},{"speaker":"Spencer","startTime":207.92,"endTime":212.33,"body":"alerts, and especially for a"},{"speaker":"Spencer","startTime":212.39,"endTime":215.03,"body":"client that knows where to go,"},{"speaker":"Spencer","startTime":212.39,"endTime":215.03,"body":"they have a soc, you know, they"},{"speaker":"Spencer","startTime":215.15,"endTime":217.55,"body":"they know where to see the"},{"speaker":"Spencer","startTime":215.15,"endTime":217.55,"body":"alerts and where to get the"},{"speaker":"Spencer","startTime":217.55,"endTime":221.02,"body":"telemetry, no alerts, and then"},{"speaker":"Spencer","startTime":217.55,"endTime":221.02,"body":"Tyler will run the same exact"},{"speaker":"Spencer","startTime":221.08,"endTime":225.31,"body":"AMZ bypass, and it'll get"},{"speaker":"Spencer","startTime":221.08,"endTime":225.31,"body":"alerted. Same CrowdStrike, you"},{"speaker":"Spencer","startTime":225.34,"endTime":229.06,"body":"know, very similar versions, but"},{"speaker":"Spencer","startTime":225.34,"endTime":229.06,"body":"the difference is the settings"},{"speaker":"Spencer","startTime":229.21,"endTime":232.45,"body":"that are enabled in the"},{"speaker":"Spencer","startTime":229.21,"endTime":232.45,"body":"CrowdStrike console, and so"},{"speaker":"Spencer","startTime":232.54,"endTime":237.16,"body":"that's what we're going to talk"},{"speaker":"Spencer","startTime":232.54,"endTime":237.16,"body":"about now. Is the settings that"},{"speaker":"Spencer","startTime":237.19,"endTime":241.74,"body":"are out of the box from these"},{"speaker":"Spencer","startTime":237.19,"endTime":241.74,"body":"EDR vendors are many times not"},{"speaker":"Spencer","startTime":242.97,"endTime":245.55,"body":"ideal, and many times they're"},{"speaker":"Spencer","startTime":242.97,"endTime":245.55,"body":"they're deficient. Like they"},{"speaker":"Spencer","startTime":245.79,"endTime":250.29,"body":"they're terrible at detecting"},{"speaker":"Spencer","startTime":245.79,"endTime":250.29,"body":"what should be detected or what"},{"speaker":"Spencer","startTime":250.74,"endTime":255.06,"body":"what somebody would expect to be"},{"speaker":"Spencer","startTime":250.74,"endTime":255.06,"body":"detected on an endpoint. So"},{"speaker":"Spencer","startTime":256.5,"endTime":259.53,"body":"Tyler, I don't know if you want"},{"speaker":"Spencer","startTime":256.5,"endTime":259.53,"body":"to pick one or start one, but I"},{"speaker":"Spencer","startTime":259.62,"endTime":262.97,"body":"think this is a really important"},{"speaker":"Spencer","startTime":259.62,"endTime":262.97,"body":"conversation, and this is going"},{"speaker":"Spencer","startTime":262.97,"endTime":266.15,"body":"to be like a really tactical"},{"speaker":"Spencer","startTime":262.97,"endTime":266.15,"body":"episode for you guys. So, if you"},{"speaker":"Spencer","startTime":266.21,"endTime":270.23,"body":"have CrowdStrike, you know, make"},{"speaker":"Spencer","startTime":266.21,"endTime":270.23,"body":"notes or refer to the show notes"},{"speaker":"Spencer","startTime":270.29,"endTime":273.56,"body":"and go check this stuff in your"},{"speaker":"Spencer","startTime":270.29,"endTime":273.56,"body":"console to see if this stuff is"},{"speaker":"Spencer","startTime":273.62,"endTime":278.24,"body":"turned on. Because if not, you"},{"speaker":"Spencer","startTime":273.62,"endTime":278.24,"body":"are essentially not able to"},{"speaker":"Spencer","startTime":278.3,"endTime":279.98,"body":"detect quite a bit of stuff."},{"speaker":"Tyler","startTime":280.97,"endTime":282.88,"body":"Yeah, and for everybody"},{"speaker":"Tyler","startTime":280.97,"endTime":282.88,"body":"out there, the section that"},{"speaker":"Tyler","startTime":282.88,"endTime":286.24,"body":"we're going to start with is"},{"speaker":"Tyler","startTime":282.88,"endTime":286.24,"body":"prevention policies. If you're"},{"speaker":"Tyler","startTime":286.27,"endTime":289.78,"body":"in your CrowdStrike console, hit"},{"speaker":"Tyler","startTime":286.27,"endTime":289.78,"body":"the hamburger button, go to"},{"speaker":"Tyler","startTime":290.29,"endTime":292.99,"body":"Endpoint Security, and then"},{"speaker":"Tyler","startTime":290.29,"endTime":292.99,"body":"there's a subsection called"},{"speaker":"Tyler","startTime":293.26,"endTime":295.57,"body":"prevention policies. That's what"},{"speaker":"Tyler","startTime":293.26,"endTime":295.57,"body":"we're going to be discussing"},{"speaker":"Tyler","startTime":295.69,"endTime":299.41,"body":"first. And to kind of build on"},{"speaker":"Tyler","startTime":295.69,"endTime":299.41,"body":"what you were saying earlier,"},{"speaker":"Tyler","startTime":299.8,"endTime":303.87,"body":"EEO. Requires tuning both to the"},{"speaker":"Tyler","startTime":299.8,"endTime":303.87,"body":"environment and the devices that"},{"speaker":"Tyler","startTime":303.87,"endTime":306.6,"body":"it's being placed on."},{"speaker":"Tyler","startTime":303.87,"endTime":306.6,"body":"CrowdStrike has a few sections"},{"speaker":"Tyler","startTime":306.63,"endTime":309.3,"body":"that you'll notice. It supports"},{"speaker":"Tyler","startTime":306.63,"endTime":309.3,"body":"Mac, Linux, and Windows"},{"speaker":"Tyler","startTime":309.39,"endTime":312.66,"body":"configurations. You'll notice"},{"speaker":"Tyler","startTime":309.39,"endTime":312.66,"body":"other sections are just Mac and"},{"speaker":"Tyler","startTime":312.72,"endTime":317.28,"body":"Windows, so you can create"},{"speaker":"Tyler","startTime":312.72,"endTime":317.28,"body":"custom detections. You can"},{"speaker":"Tyler","startTime":317.58,"endTime":321.59,"body":"create custom exclusions based"},{"speaker":"Tyler","startTime":317.58,"endTime":321.59,"body":"off devices. So it's really,"},{"speaker":"Tyler","startTime":321.74,"endTime":324.44,"body":"really meant to be tuned, and"},{"speaker":"Tyler","startTime":321.74,"endTime":324.44,"body":"that's why out of the box it is"},{"speaker":"Tyler","startTime":324.8,"endTime":327.89,"body":"kind of deficient. Is because"},{"speaker":"Tyler","startTime":324.8,"endTime":327.89,"body":"they want to allow that tuning"},{"speaker":"Tyler","startTime":327.98,"endTime":330.05,"body":"for your environment and not"},{"speaker":"Tyler","startTime":327.98,"endTime":330.05,"body":"tune it for you."},{"speaker":"Spencer","startTime":330.92,"endTime":334.04,"body":"Yeah, 100% out of the"},{"speaker":"Spencer","startTime":330.92,"endTime":334.04,"body":"box configurations for EDR are"},{"speaker":"Spencer","startTime":334.16,"endTime":337.55,"body":"not good enough, and if you're"},{"speaker":"Spencer","startTime":334.16,"endTime":337.55,"body":"not tuning it, if your SOC or"},{"speaker":"Spencer","startTime":337.61,"endTime":342.16,"body":"MSP is not tuning it, you are"},{"speaker":"Spencer","startTime":337.61,"endTime":342.16,"body":"falling behind, and you will"},{"speaker":"Spencer","startTime":342.28,"endTime":344.29,"body":"miss stuff because of it."},{"speaker":"Tyler","startTime":344.74,"endTime":346.72,"body":"Yeah. So, kind of the"},{"speaker":"Tyler","startTime":344.74,"endTime":346.72,"body":"first setting that I want to"},{"speaker":"Tyler","startTime":346.72,"endTime":350.95,"body":"talk about that I think provides"},{"speaker":"Tyler","startTime":346.72,"endTime":350.95,"body":"a lot of benefit and doesn't"},{"speaker":"Tyler","startTime":350.98,"endTime":354.13,"body":"have any performance impact. In"},{"speaker":"Tyler","startTime":350.98,"endTime":354.13,"body":"fact, this is a setting that"},{"speaker":"Tyler","startTime":354.19,"endTime":357.61,"body":"will just give you extra"},{"speaker":"Tyler","startTime":354.19,"endTime":357.61,"body":"telemetry, just because it's"},{"speaker":"Tyler","startTime":357.67,"endTime":361.35,"body":"called enhanced exploitation"},{"speaker":"Tyler","startTime":357.67,"endTime":361.35,"body":"visibility. If you're looking"},{"speaker":"Tyler","startTime":361.44,"endTime":364.32,"body":"within CrowdStrike prevention"},{"speaker":"Tyler","startTime":361.44,"endTime":364.32,"body":"policies, it is a checkbox"},{"speaker":"Tyler","startTime":364.38,"endTime":368.04,"body":"setting. Now, for any of these"},{"speaker":"Tyler","startTime":364.38,"endTime":368.04,"body":"settings, if you guys want more"},{"speaker":"Tyler","startTime":368.04,"endTime":370.38,"body":"information, you want"},{"speaker":"Tyler","startTime":368.04,"endTime":370.38,"body":"CrowdStrike recommendations,"},{"speaker":"Tyler","startTime":370.71,"endTime":373.47,"body":"click the policy that we're"},{"speaker":"Tyler","startTime":370.71,"endTime":373.47,"body":"discussing. You can see"},{"speaker":"Tyler","startTime":373.62,"endTime":376.71,"body":"CrowdStrike's description. We're"},{"speaker":"Tyler","startTime":373.62,"endTime":376.71,"body":"obviously not going to go as in"},{"speaker":"Tyler","startTime":376.8,"endTime":380.75,"body":"depth, but we're going to give a"},{"speaker":"Tyler","startTime":376.8,"endTime":380.75,"body":"high-level overview of some of"},{"speaker":"Tyler","startTime":380.75,"endTime":384.23,"body":"these settings, so enhanced"},{"speaker":"Tyler","startTime":380.75,"endTime":384.23,"body":"exploitation visibility."},{"speaker":"Tyler","startTime":384.44,"endTime":388.04,"body":"Specifically, the reason Spencer"},{"speaker":"Tyler","startTime":384.44,"endTime":388.04,"body":"and I like it is it is enabling"},{"speaker":"Tyler","startTime":388.22,"endTime":392.66,"body":"extra telemetry that is disabled"},{"speaker":"Tyler","startTime":388.22,"endTime":392.66,"body":"by default by Microsoft, and"},{"speaker":"Tyler","startTime":392.69,"endTime":395.72,"body":"this telemetry includes"},{"speaker":"Tyler","startTime":392.69,"endTime":395.72,"body":"productivity apps such as Adobe"},{"speaker":"Tyler","startTime":395.87,"endTime":400.55,"body":"Acrobat, Microsoft Word. But the"},{"speaker":"Tyler","startTime":395.87,"endTime":400.55,"body":"thing we love the most is extra"},{"speaker":"Tyler","startTime":400.64,"endTime":404.83,"body":"telemetry from command prompt,"},{"speaker":"Tyler","startTime":400.64,"endTime":404.83,"body":"PowerShell, PowerShell IAC. So"},{"speaker":"Tyler","startTime":404.95,"endTime":407.5,"body":"your command line interfaces,"},{"speaker":"Tyler","startTime":404.95,"endTime":407.5,"body":"you are going to get more out"},{"speaker":"Tyler","startTime":407.68,"endTime":408.37,"body":"of. Yeah,"},{"speaker":"Spencer","startTime":409.27,"endTime":411.88,"body":"and the reason we like"},{"speaker":"Spencer","startTime":409.27,"endTime":411.88,"body":"this is because when we do Prpl"},{"speaker":"Spencer","startTime":411.91,"endTime":416.56,"body":"team engagements, and we see"},{"speaker":"Spencer","startTime":411.91,"endTime":416.56,"body":"that the client is detecting or"},{"speaker":"Spencer","startTime":416.68,"endTime":420.61,"body":"has visibility telemetry for all"},{"speaker":"Spencer","startTime":416.68,"endTime":420.61,"body":"of the PowerShell stuff that all"},{"speaker":"Spencer","startTime":420.7,"endTime":424.68,"body":"the PowerShell techniques that"},{"speaker":"Spencer","startTime":420.7,"endTime":424.68,"body":"we are running, they have"},{"speaker":"Spencer","startTime":424.8,"endTime":428.61,"body":"everything, and what that tells"},{"speaker":"Spencer","startTime":424.8,"endTime":428.61,"body":"us is CrowdStrike is able to"},{"speaker":"Spencer","startTime":428.67,"endTime":432.06,"body":"capture it, right? CrowdStrike"},{"speaker":"Spencer","startTime":428.67,"endTime":432.06,"body":"is able to capture it, so there"},{"speaker":"Spencer","startTime":432.21,"endTime":436.86,"body":"must be some settings that"},{"speaker":"Spencer","startTime":432.21,"endTime":436.86,"body":"enable this or allow CrowdStrike"},{"speaker":"Spencer","startTime":436.92,"endTime":440.49,"body":"to capture this telemetry, which"},{"speaker":"Spencer","startTime":436.92,"endTime":440.49,"body":"is not enabled by default"},{"speaker":"Spencer","startTime":440.58,"endTime":443.66,"body":"because of the reason we just"},{"speaker":"Spencer","startTime":440.58,"endTime":443.66,"body":"said. Like a lot of times, a lot"},{"speaker":"Spencer","startTime":443.66,"endTime":447.77,"body":"of our our post exploitation"},{"speaker":"Spencer","startTime":443.66,"endTime":447.77,"body":"stuff goes unnoticed. So this is"},{"speaker":"Spencer","startTime":448.4,"endTime":451.58,"body":"really really important because"},{"speaker":"Spencer","startTime":448.4,"endTime":451.58,"body":"threat actors are still using"},{"speaker":"Spencer","startTime":451.67,"endTime":454.73,"body":"PowerShell. They're using"},{"speaker":"Spencer","startTime":451.67,"endTime":454.73,"body":"PowerShell for like click grab"},{"speaker":"Spencer","startTime":454.85,"endTime":457.73,"body":"or the fake capture stuff where"},{"speaker":"Spencer","startTime":454.85,"endTime":457.73,"body":"they trick you and say like you"},{"speaker":"Spencer","startTime":457.73,"endTime":461.53,"body":"know control you know press"},{"speaker":"Spencer","startTime":457.73,"endTime":461.53,"body":"Windows key R and press Control"},{"speaker":"Spencer","startTime":461.59,"endTime":464.14,"body":"V and then it's like a long"},{"speaker":"Spencer","startTime":461.59,"endTime":464.14,"body":"PowerShell encoded command or"},{"speaker":"Spencer","startTime":464.23,"endTime":464.5,"body":"something."},{"speaker":"Tyler","startTime":465.22,"endTime":465.31,"body":"If"},{"speaker":"Spencer","startTime":465.64,"endTime":469.12,"body":"you don't have this"},{"speaker":"Spencer","startTime":465.64,"endTime":469.12,"body":"setting enabled, you might miss"},{"speaker":"Spencer","startTime":469.33,"endTime":472.87,"body":"that telemetry, which means"},{"speaker":"Spencer","startTime":469.33,"endTime":472.87,"body":"alerts can't be created off of"},{"speaker":"Tyler","startTime":473.62,"endTime":477.04,"body":"it. It's also very very"},{"speaker":"Tyler","startTime":473.62,"endTime":477.04,"body":"important for DFIR. If you're"},{"speaker":"Tyler","startTime":477.13,"endTime":481.05,"body":"missing command line that's ran"},{"speaker":"Tyler","startTime":477.13,"endTime":481.05,"body":"that wasn't tied to a detection,"},{"speaker":"Tyler","startTime":481.62,"endTime":485.1,"body":"or wasn't included in your"},{"speaker":"Tyler","startTime":481.62,"endTime":485.1,"body":"alert, you're missing a lot of"},{"speaker":"Tyler","startTime":485.22,"endTime":488.46,"body":"crucial information. If the only"},{"speaker":"Tyler","startTime":485.22,"endTime":488.46,"body":"thing, I guess, the best example"},{"speaker":"Tyler","startTime":488.55,"endTime":491.34,"body":"I have is clients in the past"},{"speaker":"Tyler","startTime":488.55,"endTime":491.34,"body":"have shown me alerts, and the"},{"speaker":"Tyler","startTime":491.4,"endTime":495.03,"body":"only thing I see in the alert"},{"speaker":"Tyler","startTime":491.4,"endTime":495.03,"body":"panel is Miami bypass. That's"},{"speaker":"Tyler","startTime":495.03,"endTime":498.66,"body":"the only command line that was"},{"speaker":"Tyler","startTime":495.03,"endTime":498.66,"body":"captured, but that is step one"},{"speaker":"Tyler","startTime":498.99,"endTime":502.94,"body":"of an attack chain that I am now"},{"speaker":"Tyler","startTime":498.99,"endTime":502.94,"body":"going on. So, if you're missing,"},{"speaker":"Tyler","startTime":503.21,"endTime":505.52,"body":"let's say, Power View being"},{"speaker":"Tyler","startTime":503.21,"endTime":505.52,"body":"loaded, and then share"},{"speaker":"Tyler","startTime":505.58,"endTime":509.42,"body":"enumeration, etc. etc. you're"},{"speaker":"Tyler","startTime":505.58,"endTime":509.42,"body":"missing all this crucial"},{"speaker":"Tyler","startTime":509.51,"endTime":512.45,"body":"information that will paint a"},{"speaker":"Tyler","startTime":509.51,"endTime":512.45,"body":"picture of how a threat actor"},{"speaker":"Tyler","startTime":512.57,"endTime":514.88,"body":"moved in your environment and"},{"speaker":"Tyler","startTime":512.57,"endTime":514.88,"body":"what they abused in your"},{"speaker":"Tyler","startTime":514.91,"endTime":521.89,"body":"environment. The next policy"},{"speaker":"Tyler","startTime":514.91,"endTime":521.89,"body":"that we'll talk about is called"},{"speaker":"Tyler","startTime":521.95,"endTime":526.57,"body":"enhanced DLL load visibility."},{"speaker":"Tyler","startTime":521.95,"endTime":526.57,"body":"For any of these settings, by"},{"speaker":"Tyler","startTime":526.6,"endTime":529.81,"body":"the way, when you click on them,"},{"speaker":"Tyler","startTime":526.6,"endTime":529.81,"body":"CrowdStrike will recommend based"},{"speaker":"Tyler","startTime":529.9,"endTime":533.02,"body":"off phase one, two, and three"},{"speaker":"Tyler","startTime":529.9,"endTime":533.02,"body":"deployments. Phase one"},{"speaker":"Tyler","startTime":533.26,"endTime":537.07,"body":"deployment being your fastest"},{"speaker":"Tyler","startTime":533.26,"endTime":537.07,"body":"deployment for devices with AV"},{"speaker":"Tyler","startTime":537.94,"endTime":540.84,"body":"that you don't want a lot of"},{"speaker":"Tyler","startTime":537.94,"endTime":540.84,"body":"extra work in creating"},{"speaker":"Tyler","startTime":540.96,"endTime":545.7,"body":"exclusions for and things of"},{"speaker":"Tyler","startTime":540.96,"endTime":545.7,"body":"that nature, but enhanced DLL"},{"speaker":"Tyler","startTime":545.82,"endTime":549.06,"body":"load visibility collects"},{"speaker":"Tyler","startTime":545.82,"endTime":549.06,"body":"additional information on DLLs"},{"speaker":"Tyler","startTime":549.18,"endTime":553.47,"body":"that are loaded into a process."},{"speaker":"Tyler","startTime":549.18,"endTime":553.47,"body":"This will prevent malicious DLLs"},{"speaker":"Tyler","startTime":553.74,"endTime":557.94,"body":"from being side loaded into"},{"speaker":"Tyler","startTime":553.74,"endTime":557.94,"body":"applications. So this is a great"},{"speaker":"Tyler","startTime":558.0,"endTime":560.87,"body":"setting just at a base level to"},{"speaker":"Tyler","startTime":558.0,"endTime":560.87,"body":"give you that extra visibility"},{"speaker":"Tyler","startTime":561.38,"endTime":563.45,"body":"into some common attacks that"},{"speaker":"Tyler","startTime":561.38,"endTime":563.45,"body":"are abused."},{"speaker":"Spencer","startTime":564.5,"endTime":568.76,"body":"Yeah, DLL side loading"},{"speaker":"Spencer","startTime":564.5,"endTime":568.76,"body":"is a very common technique for"},{"speaker":"Spencer","startTime":570.29,"endTime":574.58,"body":"threat actors to use to get"},{"speaker":"Spencer","startTime":570.29,"endTime":574.58,"body":"their payloads running. This is"},{"speaker":"Spencer","startTime":574.58,"endTime":581.83,"body":"you know not anything novel or"},{"speaker":"Spencer","startTime":574.58,"endTime":581.83,"body":"new. And to excuse me, to have"},{"speaker":"Spencer","startTime":582.01,"endTime":587.11,"body":"settings like this not enabled"},{"speaker":"Spencer","startTime":582.01,"endTime":587.11,"body":"just reduces the visibility you"},{"speaker":"Spencer","startTime":587.17,"endTime":591.79,"body":"have so much because DLL"},{"speaker":"Spencer","startTime":587.17,"endTime":591.79,"body":"manipulation and DLL loading and"},{"speaker":"Spencer","startTime":591.88,"endTime":596.8,"body":"hijacking and all that stuff is"},{"speaker":"Spencer","startTime":591.88,"endTime":596.8,"body":"very very common for malware and"},{"speaker":"Spencer","startTime":596.92,"endTime":601.29,"body":"for like initial stage zero"},{"speaker":"Spencer","startTime":596.92,"endTime":601.29,"body":"type. Of work that threat actors"},{"speaker":"Spencer","startTime":601.38,"endTime":606.24,"body":"do, so this is again another"},{"speaker":"Spencer","startTime":601.38,"endTime":606.24,"body":"really important one that when"},{"speaker":"Spencer","startTime":606.3,"endTime":609.3,"body":"you have disabled just means"},{"speaker":"Spencer","startTime":606.3,"endTime":609.3,"body":"you're not seeing as much as you"},{"speaker":"Spencer","startTime":609.42,"endTime":611.34,"body":"should, which means you can't"},{"speaker":"Spencer","startTime":609.42,"endTime":611.34,"body":"create alerts on"},{"speaker":"Tyler","startTime":612.27,"endTime":614.28,"body":"it. And you'll notice for"},{"speaker":"Tyler","startTime":612.27,"endTime":614.28,"body":"quite a few of these settings,"},{"speaker":"Tyler","startTime":614.55,"endTime":618.03,"body":"all they're doing is giving you"},{"speaker":"Tyler","startTime":614.55,"endTime":618.03,"body":"extra visibility into X, Y, or"},{"speaker":"Tyler","startTime":618.18,"endTime":621.45,"body":"Z. The next one we're going to"},{"speaker":"Tyler","startTime":618.18,"endTime":621.45,"body":"talk about is WSL two"},{"speaker":"Tyler","startTime":621.57,"endTime":625.07,"body":"visibility. Is the name of the"},{"speaker":"Tyler","startTime":621.57,"endTime":625.07,"body":"setting. Once again, this may"},{"speaker":"Tyler","startTime":625.16,"endTime":628.37,"body":"not apply to every environment."},{"speaker":"Tyler","startTime":625.16,"endTime":628.37,"body":"So, if your environment doesn't"},{"speaker":"Tyler","startTime":628.49,"endTime":631.97,"body":"leverage WSL 2, maybe you don't"},{"speaker":"Tyler","startTime":628.49,"endTime":631.97,"body":"have any developers that are"},{"speaker":"Tyler","startTime":632.03,"endTime":635.75,"body":"leveraging that, any IT staff"},{"speaker":"Tyler","startTime":632.03,"endTime":635.75,"body":"that are leveraging that, you"},{"speaker":"Tyler","startTime":635.78,"endTime":640.37,"body":"may not need this setting. If"},{"speaker":"Tyler","startTime":635.78,"endTime":640.37,"body":"you do, I would recommend this"},{"speaker":"Tyler","startTime":640.43,"endTime":643.06,"body":"setting being enabled only on"},{"speaker":"Tyler","startTime":640.43,"endTime":643.06,"body":"the devices that it needs to be"},{"speaker":"Tyler","startTime":643.15,"endTime":645.55,"body":"enabled on, and then you can"},{"speaker":"Tyler","startTime":643.15,"endTime":645.55,"body":"leave it off your regular"},{"speaker":"Tyler","startTime":645.73,"endTime":651.13,"body":"Windows workstations. But WSL"},{"speaker":"Tyler","startTime":645.73,"endTime":651.13,"body":"two visibility again will give"},{"speaker":"Tyler","startTime":651.22,"endTime":655.96,"body":"you visibility into the Windows"},{"speaker":"Tyler","startTime":651.22,"endTime":655.96,"body":"subset system for Linux and give"},{"speaker":"Tyler","startTime":656.02,"endTime":659.08,"body":"you additional telemetry and"},{"speaker":"Tyler","startTime":656.02,"endTime":659.08,"body":"logs regarding WSL two."},{"speaker":"Spencer","startTime":660.07,"endTime":662.46,"body":"Yeah, and this again, a"},{"speaker":"Spencer","startTime":660.07,"endTime":662.46,"body":"known threat actor technique is"},{"speaker":"Spencer","startTime":663.06,"endTime":668.13,"body":"to use WCL two, just like an"},{"speaker":"Spencer","startTime":663.06,"endTime":668.13,"body":"isolated sandboxed environment,"},{"speaker":"Spencer","startTime":668.88,"endTime":672.6,"body":"to run their payloads and"},{"speaker":"Spencer","startTime":668.88,"endTime":672.6,"body":"malicious tools. You know, like"},{"speaker":"Spencer","startTime":672.72,"endTime":676.86,"body":"if you have WCL two, you can"},{"speaker":"Spencer","startTime":672.72,"endTime":676.86,"body":"install Cali, and you can"},{"speaker":"Spencer","startTime":676.86,"endTime":680.93,"body":"install Impacket and NetExec and"},{"speaker":"Spencer","startTime":676.86,"endTime":680.93,"body":"you know Metasploit and all that"},{"speaker":"Spencer","startTime":681.02,"endTime":683.72,"body":"stuff, and potentially"},{"speaker":"Spencer","startTime":681.02,"endTime":683.72,"body":"CrowdStrike wouldn't even see it"},{"speaker":"Spencer","startTime":683.87,"endTime":687.86,"body":"without these settings enabled."},{"speaker":"Spencer","startTime":683.87,"endTime":687.86,"body":"So again, this is something that"},{"speaker":"Spencer","startTime":687.92,"endTime":690.47,"body":"made the rounds. I don't know,"},{"speaker":"Spencer","startTime":687.92,"endTime":690.47,"body":"like a year or two ago, it was"},{"speaker":"Spencer","startTime":690.53,"endTime":693.53,"body":"like it made headlines. It's"},{"speaker":"Spencer","startTime":690.53,"endTime":693.53,"body":"like you can use WL2 to avoid"},{"speaker":"Spencer","startTime":693.56,"endTime":697.43,"body":"detection from CrowdStrike, and"},{"speaker":"Spencer","startTime":693.56,"endTime":697.43,"body":"it's like there it is. There's"},{"speaker":"Spencer","startTime":697.55,"endTime":700.31,"body":"the setting. Like go enable it."},{"speaker":"Tyler","startTime":700.37,"endTime":703.78,"body":"Fantastic. Yep. Another"},{"speaker":"Tyler","startTime":700.37,"endTime":703.78,"body":"thing, something threateners"},{"speaker":"commonly do","startTime":703.87,"endTime":709.6,"body":"load C sharp C"},{"speaker":"commonly do","startTime":703.87,"endTime":709.6,"body":"utilities into PowerShell. When"},{"speaker":"commonly do","startTime":709.6,"endTime":712.75,"body":"they click Run, those will load"},{"speaker":"commonly do","startTime":709.6,"endTime":712.75,"body":"it into memory. CrowdStrike has"},{"speaker":"commonly do","startTime":712.84,"endTime":715.93,"body":"a setting for that. It's called"},{"speaker":"commonly do","startTime":712.84,"endTime":715.93,"body":"memory scanning with GPU or"},{"speaker":"commonly do","startTime":716.08,"endTime":719.95,"body":"memory scanning with CPU. Now,"},{"speaker":"commonly do","startTime":716.08,"endTime":719.95,"body":"this will I recommend enabling"},{"speaker":"commonly do","startTime":720.13,"endTime":723.18,"body":"both settings on laptops that"},{"speaker":"commonly do","startTime":720.13,"endTime":723.18,"body":"you don't have an integrated"},{"speaker":"commonly do","startTime":723.33,"endTime":728.61,"body":"GPU, it will be CPU bound. But I"},{"speaker":"commonly do","startTime":723.33,"endTime":728.61,"body":"think it prefers GPU just for"},{"speaker":"commonly do","startTime":728.88,"endTime":733.38,"body":"performance considerations. If"},{"speaker":"commonly do","startTime":728.88,"endTime":733.38,"body":"you have devices that don't have"},{"speaker":"commonly do","startTime":733.5,"endTime":737.52,"body":"a lot of resources, I would"},{"speaker":"commonly do","startTime":733.5,"endTime":737.52,"body":"consider that before enabling"},{"speaker":"commonly do","startTime":737.58,"endTime":740.6,"body":"this setting. Again,"},{"speaker":"commonly do","startTime":737.58,"endTime":740.6,"body":"CrowdStrike. If you click on the"},{"speaker":"commonly do","startTime":740.63,"endTime":743.3,"body":"setting, if there are any"},{"speaker":"commonly do","startTime":740.63,"endTime":743.3,"body":"performance considerations, they"},{"speaker":"commonly do","startTime":743.36,"endTime":746.72,"body":"will be at the very bottom of"},{"speaker":"commonly do","startTime":743.36,"endTime":746.72,"body":"the setting description. So go"},{"speaker":"commonly do","startTime":746.84,"endTime":750.68,"body":"check those out if you guys have"},{"speaker":"commonly do","startTime":746.84,"endTime":750.68,"body":"any concerns. But this will"},{"speaker":"commonly do","startTime":750.71,"endTime":753.5,"body":"allow scanning and scraping of"},{"speaker":"commonly do","startTime":750.71,"endTime":753.5,"body":"anything that gets loaded inside"},{"speaker":"commonly do","startTime":753.53,"endTime":756.8,"body":"of memory. Specific techniques"},{"speaker":"commonly do","startTime":753.53,"endTime":756.8,"body":"and tactics that Spencer and I"},{"speaker":"commonly do","startTime":756.89,"endTime":759.65,"body":"do, such as loading, you know,"},{"speaker":"commonly do","startTime":756.89,"endTime":759.65,"body":"obfuscated tools that are"},{"speaker":"commonly do","startTime":759.68,"endTime":763.06,"body":"written in C sharp or C into"},{"speaker":"commonly do","startTime":759.68,"endTime":763.06,"body":"PowerShell and then loading"},{"speaker":"commonly do","startTime":763.12,"endTime":766.42,"body":"those, that will then get loaded"},{"speaker":"commonly do","startTime":763.12,"endTime":766.42,"body":"into memory and then will get"},{"speaker":"commonly do","startTime":766.51,"endTime":769.24,"body":"scanned and then we'll get"},{"speaker":"commonly do","startTime":766.51,"endTime":769.24,"body":"detected. So I think this"},{"speaker":"commonly do","startTime":769.3,"endTime":772.99,"body":"setting is great for just"},{"speaker":"commonly do","startTime":769.3,"endTime":772.99,"body":"additional protections around"},{"speaker":"commonly do","startTime":773.38,"endTime":775.78,"body":"even command line interfaces"},{"speaker":"commonly do","startTime":773.38,"endTime":775.78,"body":"that are commonly used."},{"speaker":"Spencer","startTime":776.74,"endTime":780.4,"body":"Yeah, and if you"},{"speaker":"Spencer","startTime":776.74,"endTime":780.4,"body":"remember, you know when mal or"},{"speaker":"Spencer","startTime":780.61,"endTime":784.29,"body":"when fileless malware became a"},{"speaker":"Spencer","startTime":780.61,"endTime":784.29,"body":"thing, right? When Amzi was"},{"speaker":"Spencer","startTime":784.44,"endTime":788.85,"body":"created, or just before AMZ was"},{"speaker":"Spencer","startTime":784.44,"endTime":788.85,"body":"created, this this memory"},{"speaker":"Spencer","startTime":789.33,"endTime":794.31,"body":"resident malware, if you will,"},{"speaker":"Spencer","startTime":789.33,"endTime":794.31,"body":"or offensive tooling, things"},{"speaker":"Spencer","startTime":794.37,"endTime":798.69,"body":"like that, was very popular. And"},{"speaker":"Spencer","startTime":794.37,"endTime":798.69,"body":"the part of the solution to that"},{"speaker":"Spencer","startTime":798.87,"endTime":803.42,"body":"was to read memory and look for"},{"speaker":"Spencer","startTime":798.87,"endTime":803.42,"body":"malicious strings, or you know,"},{"speaker":"Spencer","startTime":803.57,"endTime":808.43,"body":"strings of known nefarious"},{"speaker":"Spencer","startTime":803.57,"endTime":808.43,"body":"intent. Like looking for even"},{"speaker":"Spencer","startTime":808.55,"endTime":811.58,"body":"researcher names will trigger it"},{"speaker":"Spencer","startTime":808.55,"endTime":811.58,"body":"sometimes. Like if you run a"},{"speaker":"Spencer","startTime":811.67,"endTime":817.01,"body":"script with some of the creators"},{"speaker":"Spencer","startTime":811.67,"endTime":817.01,"body":"of you know like Power Review or"},{"speaker":"Spencer","startTime":817.1,"endTime":820.81,"body":"Bloodhound or Certified and"},{"speaker":"Spencer","startTime":817.1,"endTime":820.81,"body":"things like that, sometimes even"},{"speaker":"Spencer","startTime":820.9,"endTime":825.61,"body":"that would trigger detections,"},{"speaker":"Spencer","startTime":820.9,"endTime":825.61,"body":"so the a lot can be done to look"},{"speaker":"Spencer","startTime":825.73,"endTime":829.27,"body":"for suspicious strings in"},{"speaker":"Spencer","startTime":825.73,"endTime":829.27,"body":"memory, and again, and just"},{"speaker":"Spencer","startTime":829.3,"endTime":833.38,"body":"another one that it's like"},{"speaker":"Spencer","startTime":829.3,"endTime":833.38,"body":"layers, right? Like not any one"},{"speaker":"Spencer","startTime":833.38,"endTime":836.98,"body":"of these is going to be perfect,"},{"speaker":"Spencer","startTime":833.38,"endTime":836.98,"body":"but you add all this together,"},{"speaker":"Spencer","startTime":837.16,"endTime":840.16,"body":"and now all of a sudden you have"},{"speaker":"Spencer","startTime":837.16,"endTime":840.16,"body":"much more telemetry to go off of"},{"speaker":"Spencer","startTime":840.82,"endTime":844.23,"body":"and to work from than you"},{"speaker":"Spencer","startTime":840.82,"endTime":844.23,"body":"originally had, which just makes"},{"speaker":"Spencer","startTime":844.32,"endTime":847.98,"body":"the chance to detect threats"},{"speaker":"Spencer","startTime":844.32,"endTime":847.98,"body":"higher, and that's the goal,"},{"speaker":"Spencer","startTime":848.13,"endTime":851.7,"body":"right? Is like we want the best"},{"speaker":"Spencer","startTime":848.13,"endTime":851.7,"body":"opportunity possible to detect"},{"speaker":"Spencer","startTime":851.76,"endTime":855.54,"body":"threats, and we want to use our"},{"speaker":"Spencer","startTime":851.76,"endTime":855.54,"body":"investment as much as possible."},{"speaker":"Spencer","startTime":855.9,"endTime":859.29,"body":"Like you're paying a lot of"},{"speaker":"Spencer","startTime":855.9,"endTime":859.29,"body":"money for EDR, you might as well"},{"speaker":"Spencer","startTime":859.41,"endTime":861.92,"body":"turn on all the possible"},{"speaker":"Spencer","startTime":859.41,"endTime":861.92,"body":"features that you can enable"},{"speaker":"Spencer","startTime":862.49,"endTime":865.76,"body":"that are safe and you know that"},{"speaker":"Spencer","startTime":862.49,"endTime":865.76,"body":"support your environment. Like"},{"speaker":"Spencer","startTime":865.85,"endTime":867.89,"body":"you obviously don't want to"},{"speaker":"Spencer","startTime":865.85,"endTime":867.89,"body":"crush all of your machines and"},{"speaker":"Spencer","startTime":867.92,"endTime":872.03,"body":"nuke them, like so they can't"},{"speaker":"Spencer","startTime":867.92,"endTime":872.03,"body":"operate anymore. But if it were"},{"speaker":"Spencer","startTime":872.12,"endTime":874.88,"body":"me, I'd want to use all the"},{"speaker":"Spencer","startTime":872.12,"endTime":874.88,"body":"features I had available to me."},{"speaker":"Tyler","startTime":877.37,"endTime":878.99,"body":"Yeah, I think that's a"},{"speaker":"Tyler","startTime":877.37,"endTime":878.99,"body":"good note. And all of these"},{"speaker":"Tyler","startTime":879.05,"endTime":881.29,"body":"settings, Spencer and I have"},{"speaker":"Tyler","startTime":879.05,"endTime":881.29,"body":"kind of discussed previously,"},{"speaker":"Tyler","startTime":881.41,"endTime":885.43,"body":"and a lot of these impact our"},{"speaker":"Tyler","startTime":881.41,"endTime":885.43,"body":"personal pen tester processes"},{"speaker":"Tyler","startTime":886.0,"endTime":889.24,"body":"that we use in environments. And"},{"speaker":"Tyler","startTime":886.0,"endTime":889.24,"body":"if that's true for us, it's also"},{"speaker":"Tyler","startTime":889.27,"endTime":891.07,"body":"going to be true for threat"},{"speaker":"Tyler","startTime":889.27,"endTime":891.07,"body":"actors because that's who we're"},{"speaker":"Tyler","startTime":891.19,"endTime":894.73,"body":"emulating. So it's going to give"},{"speaker":"Tyler","startTime":891.19,"endTime":894.73,"body":"us a bigger headache, which"},{"speaker":"Tyler","startTime":894.82,"endTime":896.65,"body":"means inherently it's going to"},{"speaker":"Tyler","startTime":894.82,"endTime":896.65,"body":"give threat actors a bigger"},{"speaker":"Tyler","startTime":896.74,"endTime":898.93,"body":"headache, meaning your"},{"speaker":"Tyler","startTime":896.74,"endTime":898.93,"body":"environment's harder to attack."},{"speaker":"Tyler","startTime":899.05,"endTime":903.78,"body":"You're more secure as a. The"},{"speaker":"Tyler","startTime":899.05,"endTime":903.78,"body":"next setting is Microsoft Office"},{"speaker":"Tyler","startTime":904.56,"endTime":908.19,"body":"malicious macro removal. I don't"},{"speaker":"Tyler","startTime":904.56,"endTime":908.19,"body":"think this is necessary to have"},{"speaker":"Tyler","startTime":908.22,"endTime":911.31,"body":"on every machine. I don't think"},{"speaker":"Tyler","startTime":908.22,"endTime":911.31,"body":"this is necessary for every"},{"speaker":"Tyler","startTime":911.37,"endTime":915.6,"body":"market vertical. If you're not"},{"speaker":"Tyler","startTime":911.37,"endTime":915.6,"body":"regularly handling documents"},{"speaker":"Tyler","startTime":916.05,"endTime":919.8,"body":"that will contain macros, you"},{"speaker":"Tyler","startTime":916.05,"endTime":919.8,"body":"may not need this setting. Now"},{"speaker":"Tyler","startTime":920.01,"endTime":922.28,"body":"you can just have it check boxed"},{"speaker":"Tyler","startTime":920.01,"endTime":922.28,"body":"if you want the extra security."},{"speaker":"Tyler","startTime":922.46,"endTime":926.36,"body":"I think that's fine. I think"},{"speaker":"Tyler","startTime":922.46,"endTime":926.36,"body":"this is important for people"},{"speaker":"Tyler","startTime":926.42,"endTime":929.99,"body":"like accounting folks that are"},{"speaker":"Tyler","startTime":926.42,"endTime":929.99,"body":"commonly dealing with documents"},{"speaker":"Tyler","startTime":930.02,"endTime":936.08,"body":"going in and out, downloading"},{"speaker":"Tyler","startTime":930.02,"endTime":936.08,"body":"documents, and then law firms"},{"speaker":"Tyler","startTime":936.41,"endTime":938.84,"body":"are a market vertical. I also"},{"speaker":"Tyler","startTime":936.41,"endTime":938.84,"body":"think this would be important"},{"speaker":"Tyler","startTime":938.87,"endTime":942.91,"body":"for another vertical that is"},{"speaker":"Tyler","startTime":938.87,"endTime":942.91,"body":"just handling documents all the"},{"speaker":"Tyler","startTime":942.94,"endTime":947.32,"body":"time, but this will allow"},{"speaker":"Tyler","startTime":942.94,"endTime":947.32,"body":"CrowdStrike to analyze and"},{"speaker":"Tyler","startTime":947.38,"endTime":951.97,"body":"quarantine any office file that"},{"speaker":"Tyler","startTime":947.38,"endTime":951.97,"body":"it finds malicious macros inside"},{"speaker":"Tyler","startTime":952.12,"endTime":956.8,"body":"of. This was a trend. I don't"},{"speaker":"Tyler","startTime":952.12,"endTime":956.8,"body":"know when was malicious macros"},{"speaker":"Tyler","startTime":956.89,"endTime":960.54,"body":"probably a year ago. It was"},{"speaker":"Tyler","startTime":956.89,"endTime":960.54,"body":"really popular before Market the"},{"speaker":"Tyler","startTime":960.63,"endTime":963.69,"body":"Web was implemented on documents"},{"speaker":"Tyler","startTime":960.63,"endTime":963.69,"body":"that were downloaded from the"},{"speaker":"Tyler","startTime":963.69,"endTime":967.62,"body":"internet. A lot more popular"},{"speaker":"Tyler","startTime":963.69,"endTime":967.62,"body":"than, however, I still think"},{"speaker":"Tyler","startTime":967.65,"endTime":970.74,"body":"this has benefit if you are"},{"speaker":"Tyler","startTime":967.65,"endTime":970.74,"body":"handling a lot of documents that"},{"speaker":"Tyler","startTime":970.74,"endTime":974.34,"body":"are Office related. Removing"},{"speaker":"Tyler","startTime":970.74,"endTime":974.34,"body":"those macros prior to execution"},{"speaker":"Tyler","startTime":974.4,"endTime":979.14,"body":"of them just completely saves a"},{"speaker":"Tyler","startTime":974.4,"endTime":979.14,"body":"machine and a headache. You"},{"speaker":"Tyler","startTime":979.17,"endTime":981.71,"body":"know, re-provisioning a machine"},{"speaker":"Tyler","startTime":979.17,"endTime":981.71,"body":"that's now being compromised as"},{"speaker":"Tyler","startTime":981.71,"endTime":982.91,"body":"a result of those macros."},{"speaker":"Spencer","startTime":983.87,"endTime":986.36,"body":"Yeah, I think macros"},{"speaker":"Spencer","startTime":983.87,"endTime":986.36,"body":"for initial access has"},{"speaker":"Spencer","startTime":986.39,"endTime":990.56,"body":"definitely gone down quite a"},{"speaker":"Spencer","startTime":986.39,"endTime":990.56,"body":"bit, especially in favor of like"},{"speaker":"Spencer","startTime":990.8,"endTime":995.96,"body":"click the click grab capture"},{"speaker":"Spencer","startTime":990.8,"endTime":995.96,"body":"type of scams and you know like"},{"speaker":"Spencer","startTime":997.43,"endTime":999.71,"body":"what what do they call it"},{"speaker":"Spencer","startTime":997.43,"endTime":999.71,"body":"adversary in the middle or"},{"speaker":"Spencer","startTime":999.77,"endTime":1003.12,"body":"browser in the middle, kind of"},{"speaker":"Spencer","startTime":999.77,"endTime":1003.12,"body":"thing, where it's like you know,"},{"speaker":"Spencer","startTime":1003.18,"endTime":1006.72,"body":"threat actors are trying to do"},{"speaker":"Spencer","startTime":1003.18,"endTime":1006.72,"body":"credential theft to steal your"},{"speaker":"Spencer","startTime":1007.44,"endTime":1011.79,"body":"Office 365 or Microsoft 365"},{"speaker":"Spencer","startTime":1007.44,"endTime":1011.79,"body":"tokens and session keys and"},{"speaker":"Spencer","startTime":1011.82,"endTime":1014.31,"body":"stuff like that. Like that's"},{"speaker":"Spencer","startTime":1011.82,"endTime":1014.31,"body":"more common from an initial"},{"speaker":"Spencer","startTime":1014.49,"endTime":1018.78,"body":"access standpoint now than"},{"speaker":"Spencer","startTime":1014.49,"endTime":1018.78,"body":"macros because of what Tyler"},{"speaker":"Spencer","startTime":1018.93,"endTime":1023.45,"body":"said, mark of the web because of"},{"speaker":"Spencer","startTime":1018.93,"endTime":1023.45,"body":"ASR rules and like EDR is"},{"speaker":"Spencer","startTime":1023.57,"endTime":1027.65,"body":"getting good at at identifying"},{"speaker":"Spencer","startTime":1023.57,"endTime":1027.65,"body":"processes spawned from Office"},{"speaker":"Spencer","startTime":1027.74,"endTime":1030.77,"body":"applications. Like if you spawn"},{"speaker":"Spencer","startTime":1027.74,"endTime":1030.77,"body":"PowerShell from Word, like"},{"speaker":"Spencer","startTime":1031.43,"endTime":1034.31,"body":"CrowdStrike is going to see it."},{"speaker":"Spencer","startTime":1031.43,"endTime":1034.31,"body":"You know, like it's just very"},{"speaker":"Spencer","startTime":1034.7,"endTime":1038.93,"body":"obvious. But this is one of the"},{"speaker":"Spencer","startTime":1034.7,"endTime":1038.93,"body":"things that helps prevent"},{"speaker":"Spencer","startTime":1039.17,"endTime":1044.74,"body":"macro-born threats. So there's"},{"speaker":"Spencer","startTime":1039.17,"endTime":1044.74,"body":"really no downside to turn this"},{"speaker":"Spencer","startTime":1044.98,"endTime":1049.6,"body":"on, other than potential"},{"speaker":"Spencer","startTime":1044.98,"endTime":1049.6,"body":"performance impacts. But you"},{"speaker":"Spencer","startTime":1049.63,"endTime":1053.02,"body":"have to, you know, try it for"},{"speaker":"Spencer","startTime":1049.63,"endTime":1053.02,"body":"yourself and weigh those, you"},{"speaker":"Spencer","startTime":1053.05,"endTime":1054.91,"body":"know, the the cost benefit of"},{"speaker":"Spencer","startTime":1053.05,"endTime":1054.91,"body":"that."},{"speaker":"Tyler","startTime":1056.65,"endTime":1059.35,"body":"The next one I feel like"},{"speaker":"Tyler","startTime":1056.65,"endTime":1059.35,"body":"is very important across the"},{"speaker":"Tyler","startTime":1059.38,"endTime":1063.57,"body":"board. It's called file system"},{"speaker":"Tyler","startTime":1059.38,"endTime":1063.57,"body":"containment, and this enables"},{"speaker":"Tyler","startTime":1063.9,"endTime":1066.87,"body":"your CrowdStrike sensor to"},{"speaker":"Tyler","startTime":1063.9,"endTime":1066.87,"body":"respond to malicious remote file"},{"speaker":"Tyler","startTime":1067.02,"endTime":1071.07,"body":"system system activity. The"},{"speaker":"Tyler","startTime":1067.02,"endTime":1071.07,"body":"example that CrowdStrike gives"},{"speaker":"Tyler","startTime":1071.22,"endTime":1075.87,"body":"is ransomware attacks over SMB."},{"speaker":"Tyler","startTime":1071.22,"endTime":1075.87,"body":"That is what this setting is"},{"speaker":"Tyler","startTime":1075.96,"endTime":1079.29,"body":"going to help prevent. It is"},{"speaker":"Tyler","startTime":1075.96,"endTime":1079.29,"body":"going to isolate the account in"},{"speaker":"Tyler","startTime":1079.35,"endTime":1082.94,"body":"question that is performing the"},{"speaker":"Tyler","startTime":1079.35,"endTime":1082.94,"body":"activity, the endpoint is also"},{"speaker":"Tyler","startTime":1082.97,"endTime":1086.63,"body":"going to be impacted, and it's"},{"speaker":"Tyler","startTime":1082.97,"endTime":1086.63,"body":"going to stop these attack"},{"speaker":"Tyler","startTime":1086.72,"endTime":1090.8,"body":"chains before they get to the"},{"speaker":"Tyler","startTime":1086.72,"endTime":1090.8,"body":"point of no return. This is a"},{"speaker":"Tyler","startTime":1090.86,"endTime":1093.77,"body":"setting. Anywhere I see the word"},{"speaker":"Tyler","startTime":1090.86,"endTime":1093.77,"body":"ransomware, I know that's what a"},{"speaker":"Tyler","startTime":1093.92,"endTime":1096.95,"body":"lot of organizations are"},{"speaker":"Tyler","startTime":1093.92,"endTime":1096.95,"body":"concerned about. This is a"},{"speaker":"Tyler","startTime":1096.98,"endTime":1099.86,"body":"setting I would go read up on"},{"speaker":"Tyler","startTime":1096.98,"endTime":1099.86,"body":"and see the full implications of"},{"speaker":"Tyler","startTime":1099.89,"endTime":1103.12,"body":"enabling it. If your main"},{"speaker":"Tyler","startTime":1099.89,"endTime":1103.12,"body":"concern is ransomware,"},{"speaker":"Tyler","startTime":1103.72,"endTime":1107.98,"body":"CrowdStrike gave an example that"},{"speaker":"Tyler","startTime":1103.72,"endTime":1107.98,"body":"include includes ransomware as a"},{"speaker":"Tyler","startTime":1108.04,"endTime":1111.73,"body":"protection for this setting. So,"},{"speaker":"Tyler","startTime":1108.04,"endTime":1111.73,"body":"I definitely think this one is"},{"speaker":"Tyler","startTime":1111.79,"endTime":1114.73,"body":"worth enabling. If this is a"},{"speaker":"Tyler","startTime":1111.79,"endTime":1114.73,"body":"major concern of yours, I"},{"speaker":"Tyler","startTime":1114.85,"endTime":1118.63,"body":"definitely think this one is"},{"speaker":"Tyler","startTime":1114.85,"endTime":1118.63,"body":"worth reading more into as well."},{"speaker":"Spencer","startTime":1119.95,"endTime":1123.27,"body":"Yeah, and part of this"},{"speaker":"Spencer","startTime":1119.95,"endTime":1123.27,"body":"is like, like I said, it's it's"},{"speaker":"Spencer","startTime":1123.78,"endTime":1127.8,"body":"layers of controls and it's"},{"speaker":"Spencer","startTime":1123.78,"endTime":1127.8,"body":"layers of visibility that the"},{"speaker":"Spencer","startTime":1127.98,"endTime":1132.24,"body":"EDR gives you, and these are"},{"speaker":"Spencer","startTime":1127.98,"endTime":1132.24,"body":"again just a reminder. All of"},{"speaker":"Spencer","startTime":1132.3,"endTime":1135.72,"body":"these are things that"},{"speaker":"Spencer","startTime":1132.3,"endTime":1135.72,"body":"potentially are not currently"},{"speaker":"Spencer","startTime":1135.78,"endTime":1140.28,"body":"enabled in a default deployment"},{"speaker":"Spencer","startTime":1135.78,"endTime":1140.28,"body":"of CrowdStrike EDR, right?"},{"speaker":"Spencer","startTime":1140.37,"endTime":1144.29,"body":"Depending on if you self-manage"},{"speaker":"Spencer","startTime":1140.37,"endTime":1144.29,"body":"or you have an MDR provider, a"},{"speaker":"Spencer","startTime":1144.41,"endTime":1147.41,"body":"lot of these settings might not"},{"speaker":"Spencer","startTime":1144.41,"endTime":1147.41,"body":"be turned on. So you might have"},{"speaker":"Spencer","startTime":1147.44,"endTime":1150.68,"body":"a contract with an MDR provider,"},{"speaker":"Spencer","startTime":1147.44,"endTime":1150.68,"body":"and you might not have these"},{"speaker":"Spencer","startTime":1150.74,"endTime":1153.86,"body":"settings enabled. So again, just"},{"speaker":"Spencer","startTime":1150.74,"endTime":1153.86,"body":"a reminder: go check these"},{"speaker":"Spencer","startTime":1153.92,"endTime":1157.55,"body":"settings, or ask your vendor to"},{"speaker":"Spencer","startTime":1153.92,"endTime":1157.55,"body":"check that these settings are"},{"speaker":"Spencer","startTime":1157.55,"endTime":1159.35,"body":"enabled, or what the status is"},{"speaker":"Spencer","startTime":1157.55,"endTime":1159.35,"body":"of these."},{"speaker":"Tyler","startTime":1160.13,"endTime":1162.94,"body":"And as a note, we are"},{"speaker":"Tyler","startTime":1160.13,"endTime":1162.94,"body":"still in the prevention policies"},{"speaker":"Tyler","startTime":1163.0,"endTime":1165.79,"body":"page, so we have not moved on"},{"speaker":"Tyler","startTime":1163.0,"endTime":1165.79,"body":"yet. There are just this many"},{"speaker":"Tyler","startTime":1165.94,"endTime":1169.39,"body":"settings, and again, this isn't"},{"speaker":"Tyler","startTime":1165.94,"endTime":1169.39,"body":"every setting in the prevention"},{"speaker":"Tyler","startTime":1169.45,"endTime":1172.39,"body":"policies page. We've pulled out"},{"speaker":"Tyler","startTime":1169.45,"endTime":1172.39,"body":"a handful that we think are"},{"speaker":"Tyler","startTime":1172.45,"endTime":1175.87,"body":"beneficial, or prevent some"},{"speaker":"Tyler","startTime":1172.45,"endTime":1175.87,"body":"common attacks, or will just"},{"speaker":"Tyler","startTime":1175.87,"endTime":1181.53,"body":"give you extra telemetry. The"},{"speaker":"Tyler","startTime":1175.87,"endTime":1181.53,"body":"next one, this would prevent"},{"speaker":"Tyler","startTime":1181.68,"endTime":1184.38,"body":"local privilege escalation"},{"speaker":"Tyler","startTime":1181.68,"endTime":1184.38,"body":"attacks, just as a note. But"},{"speaker":"Tyler","startTime":1184.47,"endTime":1188.55,"body":"vulnerable driver protection."},{"speaker":"Tyler","startTime":1184.47,"endTime":1188.55,"body":"This the entire point of the"},{"speaker":"Tyler","startTime":1188.55,"endTime":1193.74,"body":"setting is to prevent bring your"},{"speaker":"Tyler","startTime":1188.55,"endTime":1193.74,"body":"own vulnerable driver based"},{"speaker":"Tyler","startTime":1193.8,"endTime":1197.64,"body":"attacks. This is common in"},{"speaker":"Tyler","startTime":1193.8,"endTime":1197.64,"body":"attacks such as Print Nightmare"},{"speaker":"Tyler","startTime":1198.99,"endTime":1205.1,"body":"abuses BYO. Or local privilege"},{"speaker":"Tyler","startTime":1198.99,"endTime":1205.1,"body":"escalation. This is a setting I"},{"speaker":"Tyler","startTime":1205.22,"endTime":1208.13,"body":"think you should just have"},{"speaker":"Tyler","startTime":1205.22,"endTime":1208.13,"body":"enabled. I don't know why you"},{"speaker":"Tyler","startTime":1208.16,"endTime":1211.49,"body":"wouldn't have this setting"},{"speaker":"Tyler","startTime":1208.16,"endTime":1211.49,"body":"enabled. This is using"},{"speaker":"Tyler","startTime":1211.61,"endTime":1215.0,"body":"indicators of attacks and IOCs"},{"speaker":"Tyler","startTime":1211.61,"endTime":1215.0,"body":"associated with malicious"},{"speaker":"Tyler","startTime":1215.06,"endTime":1219.5,"body":"drivers. Implementing them, if"},{"speaker":"Tyler","startTime":1215.06,"endTime":1219.5,"body":"those drivers are seen, it is"},{"speaker":"Tyler","startTime":1219.5,"endTime":1224.32,"body":"then going to quarantine them"},{"speaker":"Tyler","startTime":1219.5,"endTime":1224.32,"body":"and pop an alert for you. So, if"},{"speaker":"Tyler","startTime":1224.41,"endTime":1228.19,"body":"your local Prevask is prevented,"},{"speaker":"Tyler","startTime":1224.41,"endTime":1228.19,"body":"that gives attackers a lot less"},{"speaker":"Tyler","startTime":1228.34,"endTime":1231.55,"body":"leeway on an endpoint and makes"},{"speaker":"Tyler","startTime":1228.34,"endTime":1231.55,"body":"their job substantially harder"},{"speaker":"Tyler","startTime":1231.76,"endTime":1233.2,"body":"of getting off of that endpoint."},{"speaker":"Spencer","startTime":1233.98,"endTime":1235.87,"body":"Yeah, and if you've"},{"speaker":"Spencer","startTime":1233.98,"endTime":1235.87,"body":"heard of, if you guys are"},{"speaker":"Spencer","startTime":1235.93,"endTime":1240.04,"body":"listening and you've heard of"},{"speaker":"Spencer","startTime":1235.93,"endTime":1240.04,"body":"EDR killers and things like"},{"speaker":"Spencer","startTime":1240.1,"endTime":1245.1,"body":"that, like Terminator, all these"},{"speaker":"Spencer","startTime":1240.1,"endTime":1245.1,"body":"EDR killers, they rely on these"},{"speaker":"Spencer","startTime":1245.19,"endTime":1247.77,"body":"vulnerable drivers. So what"},{"speaker":"Spencer","startTime":1245.19,"endTime":1247.77,"body":"they'll do is they'll use a"},{"speaker":"Spencer","startTime":1247.86,"endTime":1251.94,"body":"vulnerable kernel driver, and"},{"speaker":"Spencer","startTime":1247.86,"endTime":1251.94,"body":"they will run their malware in"},{"speaker":"Spencer","startTime":1252.09,"endTime":1256.5,"body":"the kernel and kill the driver"},{"speaker":"Spencer","startTime":1252.09,"endTime":1256.5,"body":"or kill the EDR processes and"},{"speaker":"Spencer","startTime":1256.56,"endTime":1262.13,"body":"the DL DLLs and things like that"},{"speaker":"Spencer","startTime":1256.56,"endTime":1262.13,"body":"related to the EDR. This helps"},{"speaker":"Spencer","startTime":1262.31,"endTime":1268.58,"body":"mitigate that. Like this is a"},{"speaker":"Spencer","startTime":1262.31,"endTime":1268.58,"body":"direct control or mitigation to"},{"speaker":"Spencer","startTime":1268.58,"endTime":1272.54,"body":"help prevent those vulnerable"},{"speaker":"Spencer","startTime":1268.58,"endTime":1272.54,"body":"driver attacks. This is very"},{"speaker":"Spencer","startTime":1272.54,"endTime":1277.67,"body":"very prevalent with you know"},{"speaker":"Spencer","startTime":1272.54,"endTime":1277.67,"body":"more sophisticated, I would say,"},{"speaker":"Spencer","startTime":1277.79,"endTime":1283.33,"body":"threat actors. We see a lot of"},{"speaker":"Spencer","startTime":1277.79,"endTime":1283.33,"body":"vulnerable driver abuse, but ran"},{"speaker":"Spencer","startTime":1283.42,"endTime":1287.65,"body":"smart groups are using EDR"},{"speaker":"Spencer","startTime":1283.42,"endTime":1287.65,"body":"killers too. So, just a good"},{"speaker":"Spencer","startTime":1287.74,"endTime":1288.79,"body":"thing to have enabled."},{"speaker":"Tyler","startTime":1290.35,"endTime":1292.54,"body":"And all of the settings"},{"speaker":"Tyler","startTime":1290.35,"endTime":1292.54,"body":"that we've gone over so far are"},{"speaker":"Tyler","startTime":1292.75,"endTime":1295.21,"body":"checkbox settings. The next"},{"speaker":"Tyler","startTime":1292.75,"endTime":1295.21,"body":"setting we're about to discuss"},{"speaker":"Tyler","startTime":1295.3,"endTime":1298.78,"body":"is at the very bottom of"},{"speaker":"Tyler","startTime":1295.3,"endTime":1298.78,"body":"prevention policies as of the"},{"speaker":"Tyler","startTime":1298.87,"endTime":1301.35,"body":"recording of this video. That"},{"speaker":"Tyler","startTime":1298.87,"endTime":1301.35,"body":"may change in the future."},{"speaker":"Tyler","startTime":1302.13,"endTime":1306.15,"body":"However, it's called cloud-based"},{"speaker":"Tyler","startTime":1302.13,"endTime":1306.15,"body":"anomalous process execution. The"},{"speaker":"Tyler","startTime":1306.33,"endTime":1309.39,"body":"name, when I read it, was very,"},{"speaker":"Tyler","startTime":1306.33,"endTime":1309.39,"body":"very misleading. This is why"},{"speaker":"Tyler","startTime":1309.6,"endTime":1312.84,"body":"reading the description for"},{"speaker":"Tyler","startTime":1309.6,"endTime":1312.84,"body":"these prevention policies is"},{"speaker":"Tyler","startTime":1312.84,"endTime":1316.83,"body":"very important. Cloud-based"},{"speaker":"Tyler","startTime":1312.84,"endTime":1316.83,"body":"anomalous process execution"},{"speaker":"Tyler","startTime":1317.7,"endTime":1321.29,"body":"enables the CS sensor to"},{"speaker":"Tyler","startTime":1317.7,"endTime":1321.29,"body":"identify malicious activity in"},{"speaker":"Tyler","startTime":1321.47,"endTime":1327.38,"body":"living off the land binaries."},{"speaker":"Tyler","startTime":1321.47,"endTime":1327.38,"body":"Not very in tune with the name,"},{"speaker":"Tyler","startTime":1327.86,"endTime":1331.88,"body":"I will say, but I think"},{"speaker":"Tyler","startTime":1327.86,"endTime":1331.88,"body":"identifying malicious activity"},{"speaker":"Tyler","startTime":1332.21,"endTime":1336.98,"body":"in living off the land binaries"},{"speaker":"Tyler","startTime":1332.21,"endTime":1336.98,"body":"is superb. This uses AI-powered"},{"speaker":"Tyler","startTime":1337.1,"endTime":1341.0,"body":"indicators of attacks to"},{"speaker":"Tyler","startTime":1337.1,"endTime":1341.0,"body":"identify malicious activity"},{"speaker":"Tyler","startTime":1341.18,"endTime":1344.29,"body":"within those binaries, then"},{"speaker":"Tyler","startTime":1341.18,"endTime":1344.29,"body":"you're going to get alerts from"},{"speaker":"Tyler","startTime":1344.32,"endTime":1348.55,"body":"that. At a base level, this"},{"speaker":"Tyler","startTime":1344.32,"endTime":1348.55,"body":"setting is just going to give"},{"speaker":"Tyler","startTime":1348.61,"endTime":1353.56,"body":"you more detections for command"},{"speaker":"Tyler","startTime":1348.61,"endTime":1353.56,"body":"line processes. Maybe you're"},{"speaker":"Tyler","startTime":1353.62,"endTime":1358.15,"body":"worried about HTA execution."},{"speaker":"Tyler","startTime":1353.62,"endTime":1358.15,"body":"That's another LOL bin. So"},{"speaker":"Tyler","startTime":1358.36,"endTime":1362.79,"body":"there's quite a few Microsoft"},{"speaker":"Tyler","startTime":1358.36,"endTime":1362.79,"body":"Windows-based processes that"},{"speaker":"Tyler","startTime":1362.88,"endTime":1366.87,"body":"this will cover, and it already"},{"speaker":"Tyler","startTime":1362.88,"endTime":1366.87,"body":"has a list of AI-powered"},{"speaker":"Tyler","startTime":1366.96,"endTime":1370.5,"body":"indicators of attacks that it's"},{"speaker":"Tyler","startTime":1366.96,"endTime":1370.5,"body":"using to identify these"},{"speaker":"Tyler","startTime":1370.59,"endTime":1371.52,"body":"malicious behaviors."},{"speaker":"Spencer","startTime":1372.66,"endTime":1375.9,"body":"Yeah, these lol bins,"},{"speaker":"Spencer","startTime":1372.66,"endTime":1375.9,"body":"lol bins, can be used for a lot"},{"speaker":"Spencer","startTime":1375.93,"endTime":1379.35,"body":"of different things. They can be"},{"speaker":"Spencer","startTime":1375.93,"endTime":1379.35,"body":"used for code execution, so like"},{"speaker":"Spencer","startTime":1379.35,"endTime":1382.67,"body":"the HTA example Tyler just"},{"speaker":"Spencer","startTime":1379.35,"endTime":1382.67,"body":"mentioned, they can be used to"},{"speaker":"Spencer","startTime":1382.76,"endTime":1386.51,"body":"execute code, which can run"},{"speaker":"Spencer","startTime":1382.76,"endTime":1386.51,"body":"malware to like run a stage zero"},{"speaker":"Spencer","startTime":1386.75,"endTime":1390.02,"body":"or an implant, something like"},{"speaker":"Spencer","startTime":1386.75,"endTime":1390.02,"body":"that. They can be used to"},{"speaker":"Spencer","startTime":1390.17,"endTime":1393.14,"body":"download additional tools, so"},{"speaker":"Spencer","startTime":1390.17,"endTime":1393.14,"body":"like CertUtil actually can be"},{"speaker":"Spencer","startTime":1393.23,"endTime":1397.85,"body":"used to download files. You can"},{"speaker":"Spencer","startTime":1393.23,"endTime":1397.85,"body":"do a lot of interesting things"},{"speaker":"Spencer","startTime":1397.91,"endTime":1403.54,"body":"with this. You can use MS Build"},{"speaker":"Spencer","startTime":1397.91,"endTime":1403.54,"body":"to run C sharp tools, so a lot"},{"speaker":"Spencer","startTime":1403.57,"endTime":1411.22,"body":"of interesting kind of abuses to"},{"speaker":"Spencer","startTime":1403.57,"endTime":1411.22,"body":"LOL bins, and what's great is"},{"speaker":"Spencer","startTime":1411.28,"endTime":1413.62,"body":"they're built into Windows,"},{"speaker":"Spencer","startTime":1411.28,"endTime":1413.62,"body":"right? So they're inherently a"},{"speaker":"Spencer","startTime":1413.68,"endTime":1418.12,"body":"little bit more trusted. Many of"},{"speaker":"Spencer","startTime":1413.68,"endTime":1418.12,"body":"them are signed by Microsoft, so"},{"speaker":"Spencer","startTime":1418.51,"endTime":1423.12,"body":"they're just a trusted utility"},{"speaker":"Spencer","startTime":1418.51,"endTime":1423.12,"body":"in Windows. So again, another"},{"speaker":"Spencer","startTime":1423.27,"endTime":1428.13,"body":"thing to have visibility on"},{"speaker":"Spencer","startTime":1423.27,"endTime":1428.13,"body":"because a trend over the years"},{"speaker":"Spencer","startTime":1428.37,"endTime":1432.03,"body":"has been threat actors are using"},{"speaker":"Spencer","startTime":1428.37,"endTime":1432.03,"body":"more and more known, good,"},{"speaker":"Spencer","startTime":1432.24,"endTime":1438.24,"body":"trusted tools, LOL bins, RMMs,"},{"speaker":"Spencer","startTime":1432.24,"endTime":1438.24,"body":"etc. and they're using less and"},{"speaker":"Spencer","startTime":1438.27,"endTime":1441.86,"body":"less malware. So this is a good"},{"speaker":"Spencer","startTime":1438.27,"endTime":1441.86,"body":"one again to have enabled,"},{"speaker":"Tyler","startTime":1442.64,"endTime":1445.28,"body":"and this is a setting"},{"speaker":"Tyler","startTime":1442.64,"endTime":1445.28,"body":"that you can set disabled,"},{"speaker":"Tyler","startTime":1445.61,"endTime":1450.05,"body":"cautious, moderate, aggressive,"},{"speaker":"Tyler","startTime":1445.61,"endTime":1450.05,"body":"extra aggressive. Click on the"},{"speaker":"Tyler","startTime":1450.11,"endTime":1453.65,"body":"setting, read CrowdStrike"},{"speaker":"Tyler","startTime":1450.11,"endTime":1453.65,"body":"recommendations, see how you"},{"speaker":"Tyler","startTime":1453.77,"endTime":1457.1,"body":"want it applied to your"},{"speaker":"Tyler","startTime":1453.77,"endTime":1457.1,"body":"environment. Create a test group"},{"speaker":"Tyler","startTime":1457.46,"endTime":1461.38,"body":"would be my biggest"},{"speaker":"Tyler","startTime":1457.46,"endTime":1461.38,"body":"recommendation, and have it ran"},{"speaker":"Tyler","startTime":1461.41,"endTime":1465.16,"body":"against your IT staff. Run all"},{"speaker":"Tyler","startTime":1461.41,"endTime":1465.16,"body":"the settings that we've"},{"speaker":"Tyler","startTime":1465.19,"endTime":1467.86,"body":"discussed in a task group. See"},{"speaker":"Tyler","startTime":1465.19,"endTime":1467.86,"body":"how they perform in your"},{"speaker":"Tyler","startTime":1467.89,"endTime":1470.56,"body":"environment. See if you're"},{"speaker":"Tyler","startTime":1467.89,"endTime":1470.56,"body":"getting a ton of extra alerts."},{"speaker":"Tyler","startTime":1471.13,"endTime":1474.49,"body":"The goal is not for alert"},{"speaker":"Tyler","startTime":1471.13,"endTime":1474.49,"body":"fatigue for analysts or anybody"},{"speaker":"Tyler","startTime":1474.55,"endTime":1479.14,"body":"that's viewing these alerts."},{"speaker":"Tyler","startTime":1474.55,"endTime":1479.14,"body":"It's just for more detections"},{"speaker":"Tyler","startTime":1479.23,"endTime":1483.33,"body":"and more granular telemetry from"},{"speaker":"Tyler","startTime":1479.23,"endTime":1483.33,"body":"your environment, so that is the"},{"speaker":"Tyler","startTime":1483.36,"endTime":1487.35,"body":"benefit you should be getting."},{"speaker":"Tyler","startTime":1483.36,"endTime":1487.35,"body":"Not oh, we got 100 extra false"},{"speaker":"Tyler","startTime":1487.44,"endTime":1488.64,"body":"positives in the console now."},{"speaker":"Spencer","startTime":1489.33,"endTime":1492.27,"body":"Yeah. So we're gonna"},{"speaker":"Spencer","startTime":1489.33,"endTime":1492.27,"body":"we're gonna move on the next"},{"speaker":"Spencer","startTime":1492.27,"endTime":1495.9,"body":"section, but quick call to"},{"speaker":"Spencer","startTime":1492.27,"endTime":1495.9,"body":"action. We're gonna talk about"},{"speaker":"Spencer","startTime":1496.02,"endTime":1499.86,"body":"additional EDR products. I think"},{"speaker":"Spencer","startTime":1496.02,"endTime":1499.86,"body":"I think we have Sentinel One on."},{"speaker":"Spencer","startTime":1500.06,"endTime":1503.12,"body":"Docket two to talk about."},{"speaker":"Spencer","startTime":1500.06,"endTime":1503.12,"body":"There's going to be other ones."},{"speaker":"Spencer","startTime":1503.69,"endTime":1506.48,"body":"So if you like this type of"},{"speaker":"Spencer","startTime":1503.69,"endTime":1506.48,"body":"episode where we're talking"},{"speaker":"Spencer","startTime":1506.6,"endTime":1508.79,"body":"through the different console"},{"speaker":"Spencer","startTime":1506.6,"endTime":1508.79,"body":"settings and like what you need"},{"speaker":"Spencer","startTime":1508.82,"endTime":1512.06,"body":"to turn on to detect us and"},{"speaker":"Spencer","startTime":1508.82,"endTime":1512.06,"body":"detect threat actors and"},{"speaker":"Spencer","startTime":1512.09,"endTime":1516.2,"body":"malicious activity, let us know"},{"speaker":"Spencer","startTime":1512.09,"endTime":1516.2,"body":"in the comments or send us a"},{"speaker":"Spencer","startTime":1516.26,"endTime":1520.25,"body":"message and let us know one if"},{"speaker":"Spencer","startTime":1516.26,"endTime":1520.25,"body":"you like this kind of thing and"},{"speaker":"Spencer","startTime":1520.37,"endTime":1523.42,"body":"two what other EDR products or"},{"speaker":"Spencer","startTime":1520.37,"endTime":1523.42,"body":"security tools you want to see"},{"speaker":"Spencer","startTime":1523.42,"endTime":1526.66,"body":"us talk about next? Because we'd"},{"speaker":"Spencer","startTime":1523.42,"endTime":1526.66,"body":"be more than happy to do a deep"},{"speaker":"Spencer","startTime":1526.72,"endTime":1529.9,"body":"dive into that and show you, I"},{"speaker":"Spencer","startTime":1526.72,"endTime":1529.9,"body":"think, what works from our"},{"speaker":"Spencer","startTime":1529.99,"endTime":1535.03,"body":"perspective. So let us know in"},{"speaker":"Spencer","startTime":1529.99,"endTime":1535.03,"body":"the comments. So, Tyler, next"},{"speaker":"Spencer","startTime":1535.06,"endTime":1535.57,"body":"section,"},{"speaker":"Tyler","startTime":1536.29,"endTime":1540.16,"body":"hamburger button,"},{"speaker":"Tyler","startTime":1536.29,"endTime":1540.16,"body":"endpoint security, custom IOA"},{"speaker":"Tyler","startTime":1540.55,"endTime":1546.0,"body":"rule groups. Now, if you're"},{"speaker":"Tyler","startTime":1540.55,"endTime":1546.0,"body":"sitting today and you're like,"},{"speaker":"Tyler","startTime":1546.09,"endTime":1550.8,"body":"we're not blocking RMM tools,"},{"speaker":"Tyler","startTime":1546.09,"endTime":1550.8,"body":"we're not blocking X, we're not"},{"speaker":"Tyler","startTime":1550.83,"endTime":1554.67,"body":"blocking Y, we're not blocking"},{"speaker":"Tyler","startTime":1550.83,"endTime":1554.67,"body":"Z. This is where you can go to"},{"speaker":"Tyler","startTime":1555.09,"endTime":1559.68,"body":"create custom rule groups to"},{"speaker":"Tyler","startTime":1555.09,"endTime":1559.68,"body":"block applications. If you want"},{"speaker":"Tyler","startTime":1559.68,"endTime":1563.6,"body":"to block RMM tools. I know"},{"speaker":"Tyler","startTime":1559.68,"endTime":1563.6,"body":"there's websites out there that"},{"speaker":"Tyler","startTime":1563.69,"endTime":1566.69,"body":"already have a list of all the"},{"speaker":"Tyler","startTime":1563.69,"endTime":1566.69,"body":"common RMMs. I don't know it off"},{"speaker":"Tyler","startTime":1566.78,"endTime":1567.56,"body":"the top of my head."},{"speaker":"Spencer","startTime":1567.98,"endTime":1568.73,"body":"Lolrmm.io."},{"speaker":"Tyler","startTime":1570.5,"endTime":1574.85,"body":"There we go. You can go"},{"speaker":"Tyler","startTime":1570.5,"endTime":1574.85,"body":"there, pull the executables that"},{"speaker":"Tyler","startTime":1574.94,"endTime":1579.38,"body":"run from those. You can pull the"},{"speaker":"Tyler","startTime":1574.94,"endTime":1579.38,"body":"hashes that run for those. You"},{"speaker":"Tyler","startTime":1579.44,"endTime":1583.24,"body":"can add those into your custom"},{"speaker":"Tyler","startTime":1579.44,"endTime":1583.24,"body":"I/OA rule groups, you can have"},{"speaker":"Tyler","startTime":1583.3,"endTime":1587.56,"body":"alerts fire if installations are"},{"speaker":"Tyler","startTime":1583.3,"endTime":1587.56,"body":"seen, and I'm pretty sure you"},{"speaker":"Tyler","startTime":1587.59,"endTime":1590.86,"body":"can also just outright block"},{"speaker":"Tyler","startTime":1587.59,"endTime":1590.86,"body":"those from executing on the"},{"speaker":"Tyler","startTime":1590.92,"endTime":1594.91,"body":"endpoint as well. So this is a"},{"speaker":"Tyler","startTime":1590.92,"endTime":1594.91,"body":"great section to go and get"},{"speaker":"Tyler","startTime":1595.03,"endTime":1598.87,"body":"additional tuning into maybe"},{"speaker":"Tyler","startTime":1595.03,"endTime":1598.87,"body":"things CrowdStrike's not seeing"},{"speaker":"Tyler","startTime":1599.8,"endTime":1602.79,"body":"that's important to you, or"},{"speaker":"Tyler","startTime":1599.8,"endTime":1602.79,"body":"maybe things that CrowdStrike"},{"speaker":"Tyler","startTime":1602.94,"endTime":1606.75,"body":"will see, but you just want"},{"speaker":"Tyler","startTime":1602.94,"endTime":1606.75,"body":"extra alerting or protections"},{"speaker":"Tyler","startTime":1606.93,"endTime":1611.34,"body":"around that. So custom I/OA rule"},{"speaker":"Tyler","startTime":1606.93,"endTime":1611.34,"body":"groups again. You can go and"},{"speaker":"Tyler","startTime":1611.43,"endTime":1616.05,"body":"create custom blocks, even for"},{"speaker":"Tyler","startTime":1611.43,"endTime":1616.05,"body":"Windows-based applications. This"},{"speaker":"Tyler","startTime":1616.11,"endTime":1619.29,"body":"gives you what Spencer and I"},{"speaker":"Tyler","startTime":1616.11,"endTime":1619.29,"body":"call app control-a little bit of"},{"speaker":"Tyler","startTime":1619.41,"endTime":1622.28,"body":"app control within your"},{"speaker":"Tyler","startTime":1619.41,"endTime":1622.28,"body":"environment and allows you to"},{"speaker":"Tyler","startTime":1622.34,"endTime":1624.23,"body":"block certain things on certain"},{"speaker":"Tyler","startTime":1622.34,"endTime":1624.23,"body":"machines."},{"speaker":"Spencer","startTime":1625.19,"endTime":1629.99,"body":"Yeah, this is great."},{"speaker":"Spencer","startTime":1625.19,"endTime":1629.99,"body":"And lolrmm.io has like a CSV,"},{"speaker":"Spencer","startTime":1630.17,"endTime":1633.29,"body":"has a JSON. You can just"},{"speaker":"Spencer","startTime":1630.17,"endTime":1633.29,"body":"download the rules or all the"},{"speaker":"Spencer","startTime":1633.35,"endTime":1637.67,"body":"RMM tools and throw it into a"},{"speaker":"Spencer","startTime":1633.35,"endTime":1637.67,"body":"rule and block all the RMMs that"},{"speaker":"Spencer","startTime":1637.76,"endTime":1642.79,"body":"you that are in that list, other"},{"speaker":"Spencer","startTime":1637.76,"endTime":1642.79,"body":"than the ones you use. And I"},{"speaker":"Spencer","startTime":1642.82,"endTime":1646.06,"body":"mean that's that's so great."},{"speaker":"Spencer","startTime":1642.82,"endTime":1646.06,"body":"It's easy to do. It's like very"},{"speaker":"Spencer","startTime":1646.36,"endTime":1649.51,"body":"little impact to your"},{"speaker":"Spencer","startTime":1646.36,"endTime":1649.51,"body":"environment, and it's just it's"},{"speaker":"Spencer","startTime":1649.54,"endTime":1652.78,"body":"just a why not? Why wouldn't you"},{"speaker":"Spencer","startTime":1649.54,"endTime":1652.78,"body":"spend the 10 minutes to do it"},{"speaker":"Spencer","startTime":1652.81,"endTime":1653.2,"body":"kind of thing?"},{"speaker":"Tyler","startTime":1653.92,"endTime":1658.21,"body":"And again, within this"},{"speaker":"Tyler","startTime":1653.92,"endTime":1658.21,"body":"section, it's policy based,"},{"speaker":"Tyler","startTime":1658.6,"endTime":1661.44,"body":"meaning this doesn't apply to"},{"speaker":"Tyler","startTime":1658.6,"endTime":1661.44,"body":"every machine in your"},{"speaker":"Tyler","startTime":1661.47,"endTime":1664.59,"body":"environment. You can create"},{"speaker":"Tyler","startTime":1661.47,"endTime":1664.59,"body":"policies for your RMN blocks."},{"speaker":"Tyler","startTime":1665.01,"endTime":1669.6,"body":"Then you can apply that policy"},{"speaker":"Tyler","startTime":1665.01,"endTime":1669.6,"body":"to XYZ host group. So this"},{"speaker":"Tyler","startTime":1669.69,"endTime":1672.39,"body":"doesn't have to be blanket"},{"speaker":"Tyler","startTime":1669.69,"endTime":1672.39,"body":"blocks across the environment."},{"speaker":"Tyler","startTime":1672.48,"endTime":1675.6,"body":"Again, these are policies that"},{"speaker":"Tyler","startTime":1672.48,"endTime":1675.6,"body":"can be applied to specific host"},{"speaker":"Tyler","startTime":1675.63,"endTime":1683.12,"body":"groups within your CrossTrike"},{"speaker":"Tyler","startTime":1675.63,"endTime":1683.12,"body":"console. Now, if you want to get"},{"speaker":"Tyler","startTime":1683.18,"endTime":1687.35,"body":"more central control around your"},{"speaker":"Tyler","startTime":1683.18,"endTime":1687.35,"body":"firewall, I think endpoint"},{"speaker":"Tyler","startTime":1687.41,"endTime":1692.9,"body":"security firewall then policies."},{"speaker":"Tyler","startTime":1687.41,"endTime":1692.9,"body":"This allows enforcement of"},{"speaker":"Tyler","startTime":1692.99,"endTime":1696.71,"body":"firewall policies from a"},{"speaker":"Tyler","startTime":1692.99,"endTime":1696.71,"body":"CrowdStrike level on Windows."},{"speaker":"Tyler","startTime":1697.07,"endTime":1700.51,"body":"This will disable the Windows"},{"speaker":"Tyler","startTime":1697.07,"endTime":1700.51,"body":"firewall. It is the same on Mac"},{"speaker":"Tyler","startTime":1700.57,"endTime":1706.18,"body":"and Linux. This setting can be"},{"speaker":"Tyler","startTime":1700.57,"endTime":1706.18,"body":"applied across Mac, Linux, and"},{"speaker":"Tyler","startTime":1706.24,"endTime":1710.26,"body":"Windows. So if you're looking"},{"speaker":"Tyler","startTime":1706.24,"endTime":1710.26,"body":"for an easy central command to"},{"speaker":"Tyler","startTime":1710.29,"endTime":1714.25,"body":"manage your firewall rules"},{"speaker":"Tyler","startTime":1710.29,"endTime":1714.25,"body":"across all your devices, this is"},{"speaker":"Tyler","startTime":1714.31,"endTime":1718.12,"body":"a place to do it. It will enable"},{"speaker":"Tyler","startTime":1714.31,"endTime":1718.12,"body":"the firewall within CrowdStrike,"},{"speaker":"Tyler","startTime":1718.36,"endTime":1722.58,"body":"and this will give you more"},{"speaker":"Tyler","startTime":1718.36,"endTime":1722.58,"body":"granular control that you can"},{"speaker":"Tyler","startTime":1722.7,"endTime":1724.53,"body":"spit out to your environment a"},{"speaker":"Tyler","startTime":1722.7,"endTime":1724.53,"body":"lot easier,"},{"speaker":"Spencer","startTime":1725.7,"endTime":1727.83,"body":"and people a lot of"},{"speaker":"Spencer","startTime":1725.7,"endTime":1727.83,"body":"people underestimate the power"},{"speaker":"Spencer","startTime":1728.01,"endTime":1730.8,"body":"of the built-in Windows"},{"speaker":"Spencer","startTime":1728.01,"endTime":1730.8,"body":"firewall. Just for everybody"},{"speaker":"Spencer","startTime":1730.83,"endTime":1734.82,"body":"listening, if your firewall, if"},{"speaker":"Spencer","startTime":1730.83,"endTime":1734.82,"body":"your built-in Windows firewall"},{"speaker":"Spencer","startTime":1734.82,"endTime":1740.04,"body":"is disabled, then everything is"},{"speaker":"Spencer","startTime":1734.82,"endTime":1740.04,"body":"allowed. We're talking WinRM,"},{"speaker":"Spencer","startTime":1741.36,"endTime":1746.66,"body":"SMB, all the all different types"},{"speaker":"Spencer","startTime":1741.36,"endTime":1746.66,"body":"of like TCP connections. You can"},{"speaker":"Spencer","startTime":1746.81,"endTime":1752.24,"body":"ping host by default. And what's"},{"speaker":"Spencer","startTime":1746.81,"endTime":1752.24,"body":"what's really important is that"},{"speaker":"Spencer","startTime":1752.9,"endTime":1756.14,"body":"by default in Windows, you need"},{"speaker":"Spencer","startTime":1752.9,"endTime":1756.14,"body":"to be a local administrator to"},{"speaker":"Spencer","startTime":1756.26,"endTime":1760.43,"body":"modify the Windows firewall,"},{"speaker":"Spencer","startTime":1756.26,"endTime":1760.43,"body":"meaning disable it or enable it"},{"speaker":"Spencer","startTime":1760.52,"endTime":1763.21,"body":"or create or update rules. You"},{"speaker":"Spencer","startTime":1760.52,"endTime":1763.21,"body":"need to be a local"},{"speaker":"Spencer","startTime":1763.21,"endTime":1766.48,"body":"administrator, and if I'm an"},{"speaker":"Spencer","startTime":1763.21,"endTime":1766.48,"body":"attacker on an endpoint and the"},{"speaker":"Spencer","startTime":1766.57,"endTime":1770.95,"body":"built-in Windows firewall is"},{"speaker":"Spencer","startTime":1766.57,"endTime":1770.95,"body":"disabled, that means I can just"},{"speaker":"Spencer","startTime":1771.25,"endTime":1773.89,"body":"create a secondary c2 channel. I"},{"speaker":"Spencer","startTime":1771.25,"endTime":1773.89,"body":"don't have to open up the"},{"speaker":"Spencer","startTime":1773.98,"endTime":1776.68,"body":"Windows firewall at all. As long"},{"speaker":"Spencer","startTime":1773.98,"endTime":1776.68,"body":"as I can get out to the"},{"speaker":"Spencer","startTime":1776.8,"endTime":1780.36,"body":"internet, then I'm I'm golden."},{"speaker":"Spencer","startTime":1776.8,"endTime":1780.36,"body":"Like I don't have to create any"},{"speaker":"Spencer","startTime":1780.39,"endTime":1785.1,"body":"additional firewall rules or or"},{"speaker":"Spencer","startTime":1780.39,"endTime":1785.1,"body":"do any other manipulation of of"},{"speaker":"Spencer","startTime":1785.13,"endTime":1788.88,"body":"that host. So having the local"},{"speaker":"Spencer","startTime":1785.13,"endTime":1788.88,"body":"the built-in Windows firewall"},{"speaker":"Spencer","startTime":1789.03,"endTime":1792.03,"body":"enabled is really really"},{"speaker":"Spencer","startTime":1789.03,"endTime":1792.03,"body":"important. It's just a"},{"speaker":"Spencer","startTime":1792.3,"endTime":1793.83,"body":"misconfiguration we see often."},{"speaker":"Tyler","startTime":1796.44,"endTime":1799.53,"body":"And something I forgot to"},{"speaker":"Tyler","startTime":1796.44,"endTime":1799.53,"body":"mention was endpoint security."},{"speaker":"Tyler","startTime":1800.03,"endTime":1803.93,"body":"Then exclusions. If there are"},{"speaker":"Tyler","startTime":1800.03,"endTime":1803.93,"body":"specific exclusions you want to"},{"speaker":"Tyler","startTime":1803.99,"endTime":1807.2,"body":"set in your environment, if"},{"speaker":"Tyler","startTime":1803.99,"endTime":1807.2,"body":"there's a specific binary that"},{"speaker":"Tyler","startTime":1807.23,"endTime":1810.38,"body":"you're getting alert fatigue on,"},{"speaker":"Tyler","startTime":1807.23,"endTime":1810.38,"body":"you're seeing constantly it's"},{"speaker":"Tyler","startTime":1810.44,"endTime":1813.68,"body":"not providing any benefit. You"},{"speaker":"Tyler","startTime":1810.44,"endTime":1813.68,"body":"know it's a known good tool or"},{"speaker":"Tyler","startTime":1813.83,"endTime":1818.18,"body":"process within your environment."},{"speaker":"Tyler","startTime":1813.83,"endTime":1818.18,"body":"You can go set exclusions. These"},{"speaker":"Tyler","startTime":1818.24,"endTime":1821.68,"body":"can be path based. These can be"},{"speaker":"Tyler","startTime":1818.24,"endTime":1821.68,"body":"certificate based. These can be"},{"speaker":"Tyler","startTime":1822.46,"endTime":1827.44,"body":"hash based. So go check that out"},{"speaker":"Tyler","startTime":1822.46,"endTime":1827.44,"body":"if you're trying to get rid of"},{"speaker":"Tyler","startTime":1827.56,"endTime":1829.93,"body":"some common detections that"},{"speaker":"Tyler","startTime":1827.56,"endTime":1829.93,"body":"happen in your environment that"},{"speaker":"Tyler","startTime":1830.02,"endTime":1835.36,"body":"you know are known good. Just be"},{"speaker":"Tyler","startTime":1830.02,"endTime":1835.36,"body":"careful with exclusions and be"},{"speaker":"Tyler","startTime":1835.51,"endTime":1838.48,"body":"careful where you apply these"},{"speaker":"Tyler","startTime":1835.51,"endTime":1838.48,"body":"because these could make you"},{"speaker":"Tyler","startTime":1838.57,"endTime":1841.65,"body":"miss malicious activity in the"},{"speaker":"Tyler","startTime":1838.57,"endTime":1841.65,"body":"future. So I would just be"},{"speaker":"Tyler","startTime":1841.83,"endTime":1843.39,"body":"careful when setting exclusions."},{"speaker":"Spencer","startTime":1844.05,"endTime":1848.19,"body":"Yeah, 100% This is not"},{"speaker":"Spencer","startTime":1844.05,"endTime":1848.19,"body":"something you can see from the"},{"speaker":"Spencer","startTime":1848.31,"endTime":1855.81,"body":"endpoint, but having a bunch of"},{"speaker":"Spencer","startTime":1848.31,"endTime":1855.81,"body":"exclusions set is is can be very"},{"speaker":"Spencer","startTime":1855.96,"endTime":1858.39,"body":"dangerous depending on what they"},{"speaker":"Spencer","startTime":1855.96,"endTime":1858.39,"body":"are. So I would definitely echo"},{"speaker":"Spencer","startTime":1858.51,"endTime":1863.27,"body":"that. Make sure you review them"},{"speaker":"Spencer","startTime":1858.51,"endTime":1863.27,"body":"on a periodic basis. You know,"},{"speaker":"Spencer","startTime":1863.27,"endTime":1865.4,"body":"if you have something that's"},{"speaker":"Spencer","startTime":1863.27,"endTime":1865.4,"body":"going to be there long term,"},{"speaker":"Spencer","startTime":1865.52,"endTime":1869.15,"body":"just make sure you review it."},{"speaker":"Spencer","startTime":1865.52,"endTime":1869.15,"body":"Make sure that that exclusion is"},{"speaker":"Spencer","startTime":1869.21,"endTime":1872.42,"body":"still needed, because a lot of"},{"speaker":"Spencer","startTime":1869.21,"endTime":1872.42,"body":"times what happens is you know"},{"speaker":"Spencer","startTime":1872.48,"endTime":1874.97,"body":"people will set up an exclusion"},{"speaker":"Spencer","startTime":1872.48,"endTime":1874.97,"body":"to test certain things, and then"},{"speaker":"Spencer","startTime":1874.97,"endTime":1877.88,"body":"they'll forget about it, and it"},{"speaker":"Spencer","startTime":1874.97,"endTime":1877.88,"body":"just stays out there, and then"},{"speaker":"Spencer","startTime":1877.91,"endTime":1881.02,"body":"it comes back to bite them in"},{"speaker":"Spencer","startTime":1877.91,"endTime":1881.02,"body":"the future. You definitely don't"},{"speaker":"Spencer","startTime":1881.05,"endTime":1881.77,"body":"want that to happen,"},{"speaker":"Tyler","startTime":1882.37,"endTime":1885.97,"body":"and please do not set"},{"speaker":"Tyler","startTime":1882.37,"endTime":1885.97,"body":"wildcard path exclusions. Please"},{"speaker":"Tyler","startTime":1886.03,"endTime":1890.5,"body":"do not set those. Those are a"},{"speaker":"Tyler","startTime":1886.03,"endTime":1890.5,"body":"threat actor's, you know, best"},{"speaker":"Tyler","startTime":1890.53,"endTime":1894.07,"body":"dream right there. Because then,"},{"speaker":"Tyler","startTime":1890.53,"endTime":1894.07,"body":"if they find that every tool,"},{"speaker":"Tyler","startTime":1894.22,"endTime":1897.61,"body":"every process spawned from that"},{"speaker":"Tyler","startTime":1894.22,"endTime":1897.61,"body":"file path, you're not going to"},{"speaker":"Tyler","startTime":1897.61,"endTime":1901.47,"body":"have any alerts, no detections"},{"speaker":"Tyler","startTime":1897.61,"endTime":1901.47,"body":"on. So be very very careful in"},{"speaker":"Tyler","startTime":1901.53,"endTime":1905.91,"body":"setting these exclusions. The"},{"speaker":"Tyler","startTime":1901.53,"endTime":1905.91,"body":"last section that we're going to"},{"speaker":"Tyler","startTime":1905.91,"endTime":1909.09,"body":"talk about that's CrowdStrike"},{"speaker":"Tyler","startTime":1905.91,"endTime":1909.09,"body":"related is endpoint security,"},{"speaker":"Tyler","startTime":1909.39,"endTime":1912.81,"body":"and then device policies. As a"},{"speaker":"Tyler","startTime":1909.39,"endTime":1912.81,"body":"note, this can only be applied"},{"speaker":"Tyler","startTime":1912.99,"endTime":1916.86,"body":"on Mac and Windows. I did not"},{"speaker":"Tyler","startTime":1912.99,"endTime":1916.86,"body":"see support for Linux as of this"},{"speaker":"Tyler","startTime":1917.01,"endTime":1921.53,"body":"recording. That may change in"},{"speaker":"Tyler","startTime":1917.01,"endTime":1921.53,"body":"the future. This allows policies"},{"speaker":"Tyler","startTime":1921.59,"endTime":1925.61,"body":"to be set at a device level. The"},{"speaker":"Tyler","startTime":1921.59,"endTime":1925.61,"body":"best example I can give is a"},{"speaker":"Tyler","startTime":1925.67,"endTime":1929.51,"body":"policy can be created that"},{"speaker":"Tyler","startTime":1925.67,"endTime":1929.51,"body":"blocks all USB devices that are"},{"speaker":"Tyler","startTime":1929.54,"endTime":1933.17,"body":"plugged into a machine. Those"},{"speaker":"Tyler","startTime":1929.54,"endTime":1933.17,"body":"USB devices will not register on"},{"speaker":"Tyler","startTime":1933.17,"endTime":1936.95,"body":"the machine. If there's anything"},{"speaker":"Tyler","startTime":1933.17,"endTime":1936.95,"body":"on those USB devices, it's not"},{"speaker":"Tyler","startTime":1936.95,"endTime":1941.98,"body":"allowed to be read. They would"},{"speaker":"Tyler","startTime":1936.95,"endTime":1941.98,"body":"require manual review and allow"},{"speaker":"Tyler","startTime":1942.31,"endTime":1945.4,"body":"somebody with access to the"},{"speaker":"Tyler","startTime":1942.31,"endTime":1945.4,"body":"CrowdStrike console to approve"},{"speaker":"Tyler","startTime":1945.85,"endTime":1949.9,"body":"that USB to then be allowed on a"},{"speaker":"Tyler","startTime":1945.85,"endTime":1949.9,"body":"machine. So policies at the"},{"speaker":"Tyler","startTime":1949.96,"endTime":1953.05,"body":"device level can be set here"},{"speaker":"Tyler","startTime":1949.96,"endTime":1953.05,"body":"again for both your Mac and"},{"speaker":"Tyler","startTime":1953.11,"endTime":1957.97,"body":"Windows devices. And another"},{"speaker":"Tyler","startTime":1953.11,"endTime":1957.97,"body":"note: these policies can be set"},{"speaker":"Tyler","startTime":1958.0,"endTime":1962.55,"body":"to monitor only, or you can set"},{"speaker":"Tyler","startTime":1958.0,"endTime":1962.55,"body":"them to monitor and enforce. So,"},{"speaker":"Tyler","startTime":1962.58,"endTime":1966.09,"body":"if you want to create"},{"speaker":"Tyler","startTime":1962.58,"endTime":1966.09,"body":"device-based policies and not"},{"speaker":"Tyler","startTime":1966.15,"endTime":1969.6,"body":"get any alerts or enforcement,"},{"speaker":"Tyler","startTime":1966.15,"endTime":1969.6,"body":"you can do that. Just set it to"},{"speaker":"Tyler","startTime":1969.66,"endTime":1972.87,"body":"monitor-only mode. You'll still"},{"speaker":"Tyler","startTime":1969.66,"endTime":1972.87,"body":"get the telemetry from that, so"},{"speaker":"Tyler","startTime":1972.87,"endTime":1976.2,"body":"you can review it and see if"},{"speaker":"Tyler","startTime":1972.87,"endTime":1976.2,"body":"there is any exclusions or"},{"speaker":"Tyler","startTime":1976.35,"endTime":1979.89,"body":"modifications you need to make"},{"speaker":"Tyler","startTime":1976.35,"endTime":1979.89,"body":"to that policy, and then set it"},{"speaker":"Tyler","startTime":1979.92,"endTime":1980.49,"body":"to enforce."},{"speaker":"Spencer","startTime":1982.59,"endTime":1986.21,"body":"Yeah, and this is one"},{"speaker":"Spencer","startTime":1982.59,"endTime":1986.21,"body":"of those things that is maybe"},{"speaker":"Spencer","startTime":1986.27,"endTime":1990.56,"body":"not directly obvious. The reason"},{"speaker":"Spencer","startTime":1986.27,"endTime":1990.56,"body":"for it, one of the reasons is"},{"speaker":"Spencer","startTime":1990.71,"endTime":1995.0,"body":"just you know data exfil, right?"},{"speaker":"Spencer","startTime":1990.71,"endTime":1995.0,"body":"If you have, if you're worried"},{"speaker":"Spencer","startTime":1995.03,"endTime":1998.24,"body":"about insider threat, somebody"},{"speaker":"Spencer","startTime":1995.03,"endTime":1998.24,"body":"plugging in a hard drive or a"},{"speaker":"Spencer","startTime":1998.3,"endTime":2001.77,"body":"thumb drive and like siphoning"},{"speaker":"Spencer","startTime":1998.3,"endTime":2001.77,"body":"out all the data, this is one"},{"speaker":"Spencer","startTime":2001.8,"endTime":2006.87,"body":"way to to help mitigate that."},{"speaker":"Spencer","startTime":2001.8,"endTime":2006.87,"body":"The other reason is there are"},{"speaker":"Spencer","startTime":2007.02,"endTime":2011.4,"body":"devices that can resemble like a"},{"speaker":"Spencer","startTime":2007.02,"endTime":2011.4,"body":"keyboard, and when you plug them"},{"speaker":"Spencer","startTime":2011.58,"endTime":2015.42,"body":"in, they will they can execute"},{"speaker":"Spencer","startTime":2011.58,"endTime":2015.42,"body":"code. If you're familiar with"},{"speaker":"Spencer","startTime":2015.54,"endTime":2018.0,"body":"rubber duckies, that's like the"},{"speaker":"Spencer","startTime":2015.54,"endTime":2018.0,"body":"concept behind behind rubber"},{"speaker":"Spencer","startTime":2018.09,"endTime":2022.19,"body":"duckies. You can plug it in, and"},{"speaker":"Spencer","startTime":2018.09,"endTime":2022.19,"body":"it automatically will run code"},{"speaker":"Spencer","startTime":2022.31,"endTime":2024.77,"body":"that's on the rubber ducky"},{"speaker":"Spencer","startTime":2022.31,"endTime":2024.77,"body":"that's been programmed to do all"},{"speaker":"Spencer","startTime":2024.8,"endTime":2028.85,"body":"sorts of fun stuff. So there's"},{"speaker":"Spencer","startTime":2024.8,"endTime":2028.85,"body":"that implication as well, and"},{"speaker":"Spencer","startTime":2028.85,"endTime":2034.64,"body":"this is primarily for folks who"},{"speaker":"Spencer","startTime":2028.85,"endTime":2034.64,"body":"travel a lot. If you're at a"},{"speaker":"Spencer","startTime":2034.67,"endTime":2036.8,"body":"home office and you're not"},{"speaker":"Spencer","startTime":2034.67,"endTime":2036.8,"body":"worried about like insider"},{"speaker":"Spencer","startTime":2036.86,"endTime":2040.48,"body":"threaten things, like USBs, you"},{"speaker":"Spencer","startTime":2036.86,"endTime":2040.48,"body":"know, control probably not high"},{"speaker":"Spencer","startTime":2040.57,"endTime":2045.97,"body":"up on your list, but if you have"},{"speaker":"Spencer","startTime":2040.57,"endTime":2045.97,"body":"traveling folks who are commonly"},{"speaker":"Spencer","startTime":2046.09,"endTime":2048.91,"body":"like in public places, things"},{"speaker":"Spencer","startTime":2046.09,"endTime":2048.91,"body":"like that, maybe this is a good"},{"speaker":"Spencer","startTime":2049.12,"endTime":2051.46,"body":"one that you want to pay"},{"speaker":"Spencer","startTime":2049.12,"endTime":2051.46,"body":"attention to and take a look at."},{"speaker":"Tyler","startTime":2052.42,"endTime":2054.37,"body":"And there are other"},{"speaker":"Tyler","startTime":2052.42,"endTime":2054.37,"body":"policies that can be set within"},{"speaker":"Tyler","startTime":2054.4,"endTime":2057.88,"body":"the device policy section. So I"},{"speaker":"Tyler","startTime":2054.4,"endTime":2057.88,"body":"would recommend going to your"},{"speaker":"Tyler","startTime":2057.91,"endTime":2060.9,"body":"CrowdStrike console if you have"},{"speaker":"Tyler","startTime":2057.91,"endTime":2060.9,"body":"somebody that's managing it for"},{"speaker":"Tyler","startTime":2060.99,"endTime":2064.29,"body":"you. Get the information from"},{"speaker":"Tyler","startTime":2060.99,"endTime":2064.29,"body":"them, but I review the different"},{"speaker":"Tyler","startTime":2064.32,"endTime":2066.99,"body":"policies and see if there's any"},{"speaker":"Tyler","startTime":2064.32,"endTime":2066.99,"body":"that CrowdStrike offer that"},{"speaker":"Tyler","startTime":2067.02,"endTime":2069.72,"body":"would provide you benefit in"},{"speaker":"Tyler","startTime":2067.02,"endTime":2069.72,"body":"your environment. I think that's"},{"speaker":"Tyler","startTime":2069.72,"endTime":2072.54,"body":"the number one takeaway we want"},{"speaker":"Tyler","startTime":2069.72,"endTime":2072.54,"body":"everybody to have from this"},{"speaker":"episode","startTime":2072.66,"endTime":2077.31,"body":"is tune your EDR and go"},{"speaker":"episode","startTime":2072.66,"endTime":2077.31,"body":"review the settings that we've"},{"speaker":"episode","startTime":2077.37,"endTime":2080.6,"body":"mentioned and even some that we"},{"speaker":"episode","startTime":2077.37,"endTime":2080.6,"body":"haven't. The settings that are"},{"speaker":"episode","startTime":2080.63,"endTime":2082.7,"body":"going to provide the most"},{"speaker":"episode","startTime":2080.63,"endTime":2082.7,"body":"benefit are all going to be"},{"speaker":"episode","startTime":2082.91,"endTime":2087.44,"body":"within the endpoint security"},{"speaker":"episode","startTime":2082.91,"endTime":2087.44,"body":"section of CrowdStrike. That is"},{"speaker":"episode","startTime":2087.5,"endTime":2090.56,"body":"where you can do tuning for"},{"speaker":"episode","startTime":2087.5,"endTime":2090.56,"body":"prevention policies, your"},{"speaker":"episode","startTime":2090.65,"endTime":2095.03,"body":"firewall device policies. So,"},{"speaker":"episode","startTime":2090.65,"endTime":2095.03,"body":"tuning your EDR comes from that"},{"speaker":"episode","startTime":2095.09,"endTime":2097.91,"body":"endpoint security section. I"},{"speaker":"episode","startTime":2095.09,"endTime":2097.91,"body":"would recommend going through"},{"speaker":"episode","startTime":2098.03,"endTime":2101.23,"body":"all the different subsections of"},{"speaker":"episode","startTime":2098.03,"endTime":2101.23,"body":"endpoint. Security and just"},{"speaker":"episode","startTime":2101.32,"endTime":2105.28,"body":"reviewing them, taking some time"},{"speaker":"episode","startTime":2101.32,"endTime":2105.28,"body":"to just review those. And again,"},{"speaker":"episode","startTime":2105.37,"endTime":2108.22,"body":"for the prevention policies, we"},{"speaker":"episode","startTime":2105.37,"endTime":2108.22,"body":"didn't mention every setting"},{"speaker":"episode","startTime":2108.31,"endTime":2111.58,"body":"that could be enabled. So I'd"},{"speaker":"episode","startTime":2108.31,"endTime":2111.58,"body":"recommend clicking through the"},{"speaker":"episode","startTime":2111.7,"endTime":2114.67,"body":"settings, just reading through"},{"speaker":"episode","startTime":2111.7,"endTime":2114.67,"body":"them based off your environment."},{"speaker":"episode","startTime":2114.73,"endTime":2116.89,"body":"Will they provide value? Check"},{"speaker":"episode","startTime":2114.73,"endTime":2116.89,"body":"that box."},{"speaker":"Spencer","startTime":2118.239,"endTime":2123.179,"body":"Yeah. So final thoughts"},{"speaker":"Spencer","startTime":2118.239,"endTime":2123.179,"body":"here for me is these settings"},{"speaker":"Spencer","startTime":2124.289,"endTime":2127.469,"body":"meaningfully make our lives more"},{"speaker":"Spencer","startTime":2124.289,"endTime":2127.469,"body":"difficult as threat actors."},{"speaker":"Spencer","startTime":2128.999,"endTime":2132.719,"body":"These settings will provide you"},{"speaker":"Spencer","startTime":2128.999,"endTime":2132.719,"body":"more telemetry. They'll give you"},{"speaker":"Spencer","startTime":2132.779,"endTime":2138.479,"body":"more visibility. They will allow"},{"speaker":"Spencer","startTime":2132.779,"endTime":2138.479,"body":"for you to have more alerts on"},{"speaker":"Spencer","startTime":2138.659,"endTime":2141.349,"body":"things that actually matter,"},{"speaker":"Spencer","startTime":2138.659,"endTime":2141.349,"body":"like suspicious PowerShell,"},{"speaker":"Spencer","startTime":2142.279,"endTime":2146.959,"body":"suspicious macros, and malicious"},{"speaker":"Spencer","startTime":2142.279,"endTime":2146.959,"body":"macros, and WSL two type stuff,"},{"speaker":"Spencer","startTime":2147.229,"endTime":2153.289,"body":"DLL hijacking, and and DLL"},{"speaker":"Spencer","startTime":2147.229,"endTime":2153.289,"body":"abuse, all vulnerable drivers, a"},{"speaker":"Spencer","startTime":2153.469,"endTime":2157.369,"body":"lot of different things. These"},{"speaker":"Spencer","startTime":2153.469,"endTime":2157.369,"body":"will make a meaningful"},{"speaker":"Spencer","startTime":2157.399,"endTime":2161.229,"body":"difference in your ability to"},{"speaker":"Spencer","startTime":2157.399,"endTime":2161.229,"body":"detect and prevent threat actors"},{"speaker":"Spencer","startTime":2161.319,"endTime":2163.299,"body":"and kick them out of your"},{"speaker":"Spencer","startTime":2161.319,"endTime":2163.299,"body":"environment. So I encourage you"},{"speaker":"Spencer","startTime":2163.329,"endTime":2166.899,"body":"to take this one seriously and"},{"speaker":"Spencer","startTime":2163.329,"endTime":2166.899,"body":"review all the settings that we"},{"speaker":"Spencer","startTime":2167.019,"endTime":2170.199,"body":"mentioned and check them in your"},{"speaker":"Spencer","startTime":2167.019,"endTime":2170.199,"body":"environment. Because, like I"},{"speaker":"Spencer","startTime":2170.889,"endTime":2174.219,"body":"said, these are things that are"},{"speaker":"Spencer","startTime":2170.889,"endTime":2174.219,"body":"typically not enabled by"},{"speaker":"Spencer","startTime":2174.339,"endTime":2176.649,"body":"default. These are things that"},{"speaker":"Spencer","startTime":2174.339,"endTime":2176.649,"body":"oftentimes you have to go in and"},{"speaker":"Spencer","startTime":2176.709,"endTime":2180.219,"body":"make sure that they're enabled."},{"speaker":"Spencer","startTime":2176.709,"endTime":2180.219,"body":"And if you're not familiar with"},{"speaker":"Spencer","startTime":2180.339,"endTime":2184.769,"body":"EDR, your specific EDR, or"},{"speaker":"Spencer","startTime":2180.339,"endTime":2184.769,"body":"familiar with the console, you"},{"speaker":"Spencer","startTime":2184.829,"endTime":2188.579,"body":"might not even know where to go"},{"speaker":"Spencer","startTime":2184.829,"endTime":2188.579,"body":"to find a lot of the stuff. So"},{"speaker":"Spencer","startTime":2188.639,"endTime":2191.249,"body":"hopefully, this episode has"},{"speaker":"Spencer","startTime":2188.639,"endTime":2191.249,"body":"provided you kind of a roadmap"},{"speaker":"Spencer","startTime":2191.369,"endTime":2196.349,"body":"of what you should enable to"},{"speaker":"Spencer","startTime":2191.369,"endTime":2196.349,"body":"detect more threats. So Tyler,"},{"speaker":"Spencer","startTime":2197.219,"endTime":2198.959,"body":"final thoughts. If"},{"speaker":"Tyler","startTime":2199.05,"endTime":2201.29,"body":"there's other EDRs you"},{"speaker":"Tyler","startTime":2199.05,"endTime":2201.29,"body":"guys are using that you'd like"},{"speaker":"Tyler","startTime":2201.29,"endTime":2204.08,"body":"to see. Let us know. I think the"},{"speaker":"Tyler","startTime":2201.29,"endTime":2204.08,"body":"other two that we're planning to"},{"speaker":"Tyler","startTime":2204.2,"endTime":2206.87,"body":"review off the top of my head"},{"speaker":"Tyler","startTime":2204.2,"endTime":2206.87,"body":"are Sentinel One and Defender"},{"speaker":"Tyler","startTime":2206.96,"endTime":2211.28,"body":"for Endpoint. So if there's any"},{"speaker":"Tyler","startTime":2206.96,"endTime":2211.28,"body":"outside of that, shoot us a"},{"speaker":"Tyler","startTime":2211.28,"endTime":2212.27,"body":"message. Let us know."},{"speaker":"Spencer","startTime":2213.169,"endTime":2215.779,"body":"Yeah, absolutely. So"},{"speaker":"Spencer","startTime":2213.169,"endTime":2215.779,"body":"that's all the time we got for"},{"speaker":"Spencer","startTime":2215.899,"endTime":2219.139,"body":"today. If you enjoyed this"},{"speaker":"Spencer","startTime":2215.899,"endTime":2219.139,"body":"episode, make sure you leave us"},{"speaker":"Spencer","startTime":2219.169,"endTime":2221.799,"body":"a comment and let us know what"},{"speaker":"Spencer","startTime":2219.169,"endTime":2221.799,"body":"EDR you want to see next? If you"},{"speaker":"Spencer","startTime":2221.919,"endTime":2227.079,"body":"like this episode, if you just"},{"speaker":"Spencer","startTime":2221.919,"endTime":2227.079,"body":"want to troll us, meme whatever,"},{"speaker":"Spencer","startTime":2227.559,"endTime":2230.349,"body":"like super appreciate it. We"},{"speaker":"Spencer","startTime":2227.559,"endTime":2230.349,"body":"read every single comment. We"},{"speaker":"Spencer","startTime":2230.439,"endTime":2234.459,"body":"may not reply to everyone, but"},{"speaker":"Spencer","startTime":2230.439,"endTime":2234.459,"body":"we do read every single one. You"},{"speaker":"Spencer","startTime":2234.519,"endTime":2238.839,"body":"can find all of our content on"},{"speaker":"Spencer","startTime":2234.519,"endTime":2238.839,"body":"Offsec blog, and if you want to"},{"speaker":"Spencer","startTime":2238.839,"endTime":2242.009,"body":"work with us on a pen test,"},{"speaker":"Spencer","startTime":2238.839,"endTime":2242.009,"body":"particularly internal pen"},{"speaker":"Spencer","startTime":2242.039,"endTime":2244.319,"body":"testing, because that's you know"},{"speaker":"Spencer","startTime":2242.039,"endTime":2244.319,"body":"Tyler and I's bread and butter"},{"speaker":"Spencer","startTime":2244.469,"endTime":2248.819,"body":"and external for Tyler a bit"},{"speaker":"Spencer","startTime":2244.469,"endTime":2248.819,"body":"more. Check us out at"},{"speaker":"Spencer","startTime":2250.229,"endTime":2253.409,"body":"secureit360.com, and depending"},{"speaker":"Spencer","startTime":2250.229,"endTime":2253.409,"body":"on when this episode goes live,"},{"speaker":"Spencer","startTime":2255.329,"endTime":2259.019,"body":"I'll be at DefCon here leaving"},{"speaker":"Spencer","startTime":2255.329,"endTime":2259.019,"body":"tomorrow. So today's the fifth."},{"speaker":"Spencer","startTime":2259.109,"endTime":2261.619,"body":"I'm going out tomorrow. So if"},{"speaker":"Spencer","startTime":2259.109,"endTime":2261.619,"body":"you're going to be at Def Con,"},{"speaker":"Spencer","startTime":2261.649,"endTime":2264.829,"body":"if you hear this episode while"},{"speaker":"Spencer","startTime":2261.649,"endTime":2264.829,"body":"DefCon is happening, I'll be at"},{"speaker":"Spencer","startTime":2264.859,"endTime":2267.769,"body":"Red Team Village. So come check"},{"speaker":"Spencer","startTime":2264.859,"endTime":2267.769,"body":"me out. Other than that, we'll"},{"speaker":"Spencer","startTime":2267.799,"endTime":2268.789,"body":"see you guys in the next"},{"speaker":"Spencer","startTime":2267.799,"endTime":2268.789,"body":"episode."}]}