I’ve delivered many on-prem deployments, and the patterns there are predictable. You understand the topology, you control the links, and the firewall sits exactly where you place it. Moving the same technology into Azure breaks a few assumptions. Interfaces stop being physical points in the path and live behind load balancers. Routing becomes explicit and… Read More »VM-Series in Azure: Adapting On-Prem Knowledge to Cloud Reality
Most E/XDR marketing claims fall apart the moment you compare them against something measurable, and MITRE ATT&CK Evaluations are one of the few places where the hype meets a controlled, repeatable test. The results look simple on the surface, but the evaluation is not a ranking and never tries to be one. MITRE focuses on… Read More »MITRE as a cold reality check for E/XDR vendors
Some time ago I posted an article about the differences between a good EDR product and a legacy AV. As we can see, AV products are not relevant anymore, but still more than 50% of companies use them as their main endpoint protection solution. Ok, so we know that AV is obsolete, so the next… Read More »E/XDR Testing – The Illusion of Evaluation
Every vendor keeps evolving their products, and from time to time they release a “new revolutionary version.” Marketing always claims it’s a game changer in the industry 🙂 Palo Alto Networks just released PAN-OS 12.1.x (after 12.0.x). Marketing says it’s innovative software with quantum protection and other fancy words. Let’s skip the hype and look… Read More »PAN-OS 12 – What’s New
As an engineer working in the integrator business and supporting endpoint security solutions (EPP / EDR / XDR), I still meet many administrators who believe that antivirus alone provides effective protection. Antivirus solutions are signature-based: to detect a threat you first need a signature, and the AV database must be updated. That model worked well… Read More »Why antivirus alone is no longer enough — AV vs EDR/XDR
The last part of DNS security scenarios — this time DNS will be used as a command and control (C2) channel. DNS has limitations, which is why using it for data transfer is quite slow and impractical. However, using it for a C2 channel is a completely different story. My lab scenario For C2 communications,… Read More »DNS tunneling vs network security controls part 5
The next part of my DNS protection and identification series – this time focusing on DGA (Domain Generation Algorithm). DGAs are used to evade traditional IOCs such as static domains and IP addresses. How does it work? It’s quite simple: a compromised host continuously generates domain names and sends DNS queries. If one of those… Read More »DNS tunneling vs network security controls part 4 – DGA
Again, for testing purposes, I used my blog domain letsnet.eu, which has a good reputation. My exfiltration script was written in PowerShell (thanks, ChatGPT!). The script splits a PDF file into chunks, encodes each chunk in Base64, and then makes a DNS request for the A record of the sub‑domain chunk‑in‑base64.letsnet.eu that represents each chunk.… Read More »DNS tunneling vs network security controls part 3 – Exfiltration
For all testing purposes, I used my blog domain letsnet.eu, which has a good reputation. I created multiple subdomains with TXT records, where I stored a base64-encoded file. A PowerShell script queries these letsnet.eu subdomains for TXT records. The script then decodes the base64 content, assembles the file chunk by chunk, and saves it to… Read More »DNS tunneling vs network security controls part 2 – Infiltration
DNS is a challenging protocol from a security perspective. We can’t simply block DNS communication due to its recursive nature. If a device needs to communicate with the internet, DNS is essential. Threat actors are well aware of this and often abuse DNS for malicious purposes in various ways. DNS can be used to exfiltrate… Read More »DNS Tunneling vs network security products part 1