crowdstrike

You'll also be checking IDS logs and working with tools like ThreatStack, CrowdStrike, Suricata, etc.

Windows had a few such bugs exploited by real attackers as zerodays in the last month (check CrowdStrike and FireEye blogs).

Warburg Pincus participated in a $26M Series A in CrowdStrike in February 2012.

While back crowdstrike managed to simultaneously crash every windows computer and bring every major company to a halt and somehow are still around.

Corporate Windows == CrowdStrike, Sentinel One, or other US Government in disguise Malware.

Not to mention the fact that CrowdStrike Falcon incident had clearly demonstrated that Microsoft is more than happy to sign utterly insecure garbage.

CrowdStrike says that it hooks vfs_read and if the data read contains the line it injects into /etc/rc.local, it is removed from the read buffer.

If anyone can get Crowdstrike to go bankrupt I will be rooting for them.

I don't think many or any virus or ransomware has ever had as big an impact at one time as Crowdstrike did.

Did you read the post on crowdstrike in detail?

Contact me at dennis.opacki (at) crowdstrike (dot) com.

Microsoft signed the Crowdstrike updates.

CrowdStrike in particular concludes, "Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely.

> If it's "how to be a Splunk or Crowdstrike" admin or "how to be an L1 SOC" I don't think that is a hireable skill at this point.

Crowdstrike, Sophos, don't care- you can't run anything that will catch everything, so the answer is boring: Isolate and prevent any intrusion to begin with.

However, these companies do not share Crowdstrike's or FireEye's niche industry, which is tracking and defending against targeted and government-sponsored groups.

Crowdstrike claims to have been tracking the NK group that did it for years.