CROWDSTRIKE -CYMULATE TASK
· Installing the Cymulate agent inside a virtual machine running on ESXi with the Falcon agent already deployed (Windows + Linux).
· Running tests for the Endpoint Security module in Cymulate.
· Monitoring the CrowdStrike Falcon platform during testing to identify generated alerts.
· Post-Cymulate test report analysis:
o Analyzing 2 undetected anomalies to determine why they were not detected.
o Analyzing 2 detected anomalies on Falcon to determine why they were detected.
Installing the Cymulate agent inside a virtual machine running on ESXi with the Falcon agent already deployed (Windows + Linux).
DEPLOYING FALCON SENSOR ON UBUNTU MACHINE:
WINDOWS:
Get Gardash Aliyev’s stories in your inbox
Join Medium for free to get updates from this writer.
The installation and configuration processes for the Windows agent using one of the methods, “Cymulate Agent Installer.exe”, are as follows:
The figure below illustrates the connection phase between the installed agent and Cymulate during the configuration stage:
AGENT SUCCESSFULLY INSTALLED
SERVICE MENU:
· The test result for the Cymulate Endpoint Security module is as follows. Detailed information regarding the test is provided here:
The figure below shows the number of exposures detected by Falcon NextGen SIEM:
- Identifying the generated alerts by monitoring the CrowdStrike Falcon platform during testing:
Here, a number of low, medium, and high-severity detections are included:
Post-Cymulate test report analysis:
o Analyzing 2 undetected anomalies to determine why they were not detected:
- Exfiltration using psftp
Anomaly analysis and reasons for non-detection:
As can be seen from the figures below, the improper configuration of the EDR, combined with the sending of 47 requests and the failure to generate any alerts based on these requests, resulted in the detection process failing to take place.
2) Boot or Logon autostart execution: Time Providers
o Analyzing 2 detected anomalies on Falcon to determine why they were detected
- DETECTION (POWERSHELL.EXE) Information regarding the detected anomaly:
The detection process is detailed below:
In these figures, it is possible to view and analyze in detail the name of the malicious anomaly, its behaviors, the results and descriptions of those behaviors, as well as how its actions map to the specific tactics and techniques within the ATT&CK framework.
Timeline of the anomaly occurrence process:
2. DETECTION (SHARPCRASHEVENTLOG.EXE)
Information regarding the detected anomaly:
The detection process is detailed below:
In these figures, it is possible to view and analyze in detail the name of the malicious anomaly, its behaviors, the results and descriptions of those behaviors, as well as how its actions map to the specific tactics and techniques within the ATT&CK framework.
Timeline of the anomaly occurrence process:
