gregolde

Posting for a friend that was nuked by automod -

I have been attempting to install Kasm on a Linux VPS, and have been running into an issue during the installation process. After running install.sh, my Linux machine crashes when the installer gets to the following line in the "pulling default workspaces images" section: 7cb0ddc64e32: Waiting

After restarting my VPS, Kasm is running and the web portal is accessible, but I am unable to see the default credentials created by the installer until I reset them, and I'm not confident the install completed cleanly. 

I am currently running Debian 11, but have attempted installing Kasm on Ubuntu 20.04 and Ubuntu 22 and ran into the same issue

Curious if anyone has encountered this before - I have a 2 different Fortigates on 7.2 code and one has Internet Service Databases for Shodan scanners where the other does not. I'm not seeing any license difference and was curious if anyone had thoughts on why it might be missing before I talked to support.

Hello!

I've been using Elastic Agents on Windows with numerous integrations (security/event logs/O365), however I just can't get any integration that's syslog based (Sonicwall, Fortigate, Sophos) to work through a Windows based Elastic Agent.

I can confirm syslog traffic is making it to my host, so it's not firewall related (even tried turning the firewall off) - wireshark shows that the logs are arriving to the appropriate port on my hosts, however when I set up an integration on an agent, the logs are never picked up. I can make this work with a standard filebeat, but when I bring in the Elastic Agent (which is technically just managing filebeat under the hood) nothing happens.

I'm run

Curious if anyone is using Wireguard in Azure and if so, what size VM instance and what speeds are you seeing?

I've tried everything from 1cpu/1gb ram to 2cpu/8gb ram instance sizes in multiple datacenters and don't see speeds beyond 10mbps. Identical setup process in Digital ocean on 2cpu/2gb ram vm runs at speeds around 70mbps.

Really not sure what's going on and wondering if maybe it's not just me?

Was practicing some hunting on an endpoint yesterday and the answer I came to from Crowdstrike event searching doesn't match the answer I came to from analysis on the host. Hoping someone might have an explanation on what I've missed. Here's my story:

I was hunting an IP on a host - 72.21.81.200. From Crowdstrike, I ran an event search for that IP and found my event:

https://imgur.com/a/eVuXNpW

I pivoted from that event to the process tree to see what was calling out to that IP. Based on this output, it looks like searchapp.exe is my source. (I also checked other events for this IP and they all pointed to the same exe):

https://imgur.com/a/W7RginB

Locally on the host, I ran netstat

I've been working on my filebeat config trying to drop fields that I don't need that are created by filebeat and I'm not having any success. I don't see anything wrong with my config, and filebeat is working, just ignoring the drop_fields.

I've tried this with two different inputs, both syslog and log files without any luck. Can anyone please take a look at my config and tell me what I'm missing? This is driving me crazy. I've omitted everything not related to an input or a processor in the config just to cover relevance.

    # ============================== Filebeat inputs ===============================

filebeat.inputs:

- type: syslog
  enabled: true
  format: a

I've been testing detection of powershell processes after getting a start with the related CQF that was previously posted. I'm struggling to find the full command line value when running invoke-webrequest from a powershell window spawned by the user. The event data just returns "powershell.exe" in the command line field instead of what was entered like "invoke-webrequest http://somesite.com/virus.txt -output virus.txt"

Is there something I'm missing, or is the command line value not supposed to return this type of info when powershell commands are executed in an interactive powershell instance?

Curious if anyone has come across a good way to collect agent WAN IP's and report on them. My organization tracks when an employee decides to take a device out of the country. Right now I just review the sensor dashboards to see the map of where devices are checking in from. I'd like to be able to alert on this or query the data in a more automated fashion instead of checking dashboards every day/week. Falcon Data Replication seems like overkill for this, but I'm not sure of another way to accomplish it.

Trying to understand the quarantine process in Crowdstrike. When a detection event occurs, Crowdstrike can auto quarantine a file and if configured, Crowdstrike can upload that file to be able to download the file from the cloud.

What happens if you don't upload that file? Is it stored on disk?

On a Mac, I see the Falcon/Quarantine directory creates a csq file with the hash of the file in question, but it doesn't seem to be the full file. Can that file be recovered, or does it have to be restored somehow? Is it somewhere else I'm missing?

If there's any documentation that details this I must be missing it. Didn't see anything in the docs.

Having trouble running Automactc via RTR. Getting the following:

runscript -Raw=/usr/bin/python automactc.py -m all Traceback (most recent call last): File "automactc.py", line 37, in <module> from modules.common.functions import finditem ImportError: No module named modules.common.functions

Did some searching and haven't seen anyone else with this issue, curious if anyone has encountered this before.

With the release of Notification Workflows I've tried to set up integation with PagerDuty without success. Is anyone using this integration?

I have a support case open, but there hasn't been any progress yet. Initially the integration said it wasn't configured when it was, and then all tests failed, now attempting to remove the integration and it fails with "currently in use", even after removing all notification workflows. I know it's a new release, but I'm just curious if anyone actually has gotten this working yet.

From the Host Dashboard you have the ability to select a host and disable detection. My understanding is that this only impacts detections and not preventions. Unless my understanding is wrong I can't understand where this feature comes in handy. Can anyone fill in a use case?

Any ETA on when FFC will be available? I see it listed as coming soon in the Crowdstrike store.

Having trouble with installing bitwarden on windows. Running the install:

Invoke-RestMethod -OutFile bitwarden.ps1 ` -Uri https://go.btwrdn.co/bw-ps .\bitwarden.ps1 -install .\bitwarden.ps1 -start

and the installation fails with a failure to create directories and access to the docker path is denied:

mkdir: cannot create directory '/bitwarden/env': Operation not permitted mkdir: cannot create directory '/bitwarden/docker': Operation not permitted mkdir: cannot create directory '/bitwarden/ssl': Operation not permitted mkdir: cannot create directory '/bitwarden/identity': Operation not permitted mkdir: cannot create directory '/bitwarden/nginx': Operation not permitted mkdir: cannot c

My CS instance shows a number of failed login attempts on a multitude of hosts (some login attempts in the range of 1k per minute), however they all have the same login error: Domain User Already Logged In

Reviewing the Investigate details for a host's login history does not reflect this activity and appears normal. Does anyone else see similar activity in their CS instance?