Stolen Signed Drivers: The Privilege Escalation Threat You Need To Know About.

In this enlightening video, we dive deep into the realm of privilege escalation, uncovering the hidden dangers associated with stolen signed drivers. Join us as we explore the powerful tools-MISP, Elastic SIEM, and loldrivers.io-that can help you detect and mitigate this critical security threat.
In this video, we showcase the indispensable role of MISP, a leading threat intelligence platform, in detecting and sharing information about stolen signed drivers. We'll also highlight the capabilities of Elastic SIEM, a robust security information, and event management system, in monitoring and alerting against privilege escalation attempts. Additionally, we'll introduce you to loldrivers.io, a cutting-edge tool designed to assist in the identification and analysis of compromised or malicious drivers.
Armed with this knowledge, you'll learn how to leverage these powerful tools in unison, creating a comprehensive defense against privilege escalation attacks. We'll guide you through the process of integrating MISP, Elastic SIEM, and loldrivers.io into your security infrastructure, empowering you to proactively detect, investigate, and respond to threats related to stolen signed drivers.
Stay ahead of the curve in cybersecurity by watching our video on detecting privilege escalation with MISP, Elastic SIEM, and loldrivers.io. Enhance your understanding of this pervasive threat, and ensure the safety of your systems and sensitive data.
MISP: www.misp-proje...
Elastic SIEM: www.elastic.co...
Living off the Land Drivers: loldrivers.io
CVE-2021-31728: github.com/irq...

[@L33tb1nary]

Defender wasn´t running as you demonstrated on the machine, right? because 'kernel_exec.exe' will be flagged as it´s touching the disk

[@CyberAttackDefense]

I got it by defender but the EDR on that host was Cortex XDR.