The Current State of Exploit Development, Part 2
In Part 1 of this two-part blog series, we addressed binary exploitation on Windows systems, including some legacy and contemporary mitigations that…
From The Front Lines
Response When Minutes Matter: RDP — Remote Desktop Pwnage, Part 2
In Part 1 of this two-part “Tales from the Trenches” blog, we examined a stealthy Remote Desktop Protocol (RDP) intrusion uncovered by…
Response When Minutes Matter: RDP — Remote Desktop Pwnage, Part 1
Welcome to the CrowdStrike® Falcon CompleteTM team’s first “Tales from the Trenches” blog, where we describe a recent intrusion that shows how…
The Current State of Exploit Development, Part 1
Memory corruption exploits have historically been one of the strongest accessories in a good red teamer's toolkit. They present an easy win…
Attackers Are Trying to Take a Bite Out of the Apple
Over the past year, CrowdStrike® Services has observed threat actors increasingly targeting macOS environments — and using relatively unsophisticated methods to gain…
Manufacturing Industry in the Adversaries’ Crosshairs
Since January 2020, the CrowdStrike® Falcon OverWatch™ managed threat hunting team has observed an escalation in hands-on-keyboard activity. The COVID-19 pandemic has…
Automating Remote Remediation of TrickBot via Falcon’s Real Time Response API: Part 2
This is Part 2 in a two-part blog series covering the CrowdStrike® Falcon Complete™ team’s ability to remotely remediate “TrickBot,” a modular…
Automating Remote Remediation of TrickBot via Falcon’s Real Time Response API: Part 1
The combination of commodity banking malware and ransomware is nothing new in the threat landscape. Adversaries continue to develop new tactics that…
Attackers Are Targeting Cloud Service Providers
Companies are increasingly relying on cloud-based infrastructure, especially as more of their employees are working remotely — and may continue to do…
CrowdStrike’s work with the Democratic National Committee: Setting the record straight
June 5, 2020 UPDATE Blog update following the release of the testimony by Shawn Henry, CSO and President of CrowdStrike Services, before…