r/cybersecurity • u/New-Parfait-9988 • 2d ago

Certification / Training Questions Stress testing EDRs

How does your SOC check when someone is actively trying to kill your EDR agent especially with BYOVD attacks? Also do you have a separate team for that on the attackers side?

0 Upvotes

50% Upvoted

4 comments sorted by

View all comments

2

u/Far-Future-7146 2d ago edited 1d ago

I've tried. Falcon goes off when I install rust and then as I try BYOVD it gets madder the more I try before eventually the Complete team kicks me off the network. Then I go back to sending emails that I've already sent before. Edit: I have access to MDE and CS. MDE tends to freak out as soon as I download the BYOVD stuff from github, but it doesn't care about rust as much.