What's the greatest method of improving the signal to noise ratio of detection logic? Prevention
Show this thread
-
Forever hitting it home with great tweets
@mattifestation...
.
yarh- that dont help much when there is fine signed ms driver to dump with. the whql requirement is only if driver gets installed with .infhttps://docs.microsoft.com/en-us/sysinternals/downloads/livekd …
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Thanks for sharing that single exception. There is no perfect form of prevention. WDAC can be used to block execution of LiveKD. If all attackers wanted to shift to LiveKD for dumping, the detection S|N would be incredibly high.
-
Indeed. Strong prevention + strong detection are worth more than the sum of their parts. Because they reinforce each other and set each other up for success.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.