Checking what ran on the endpoint

I searched client records for the behaviours seen during controlled execution. They did not show corresponding MSBuild activity, C2 communication or Autorun persistence after CrowdStrike interrupted the chain. The report preserved that distinction when describing detection-relevant behaviour.

Incident response Malware analysis Static malware analysis Dynamic malware analysis PowerShell Process Monitor (Procmon)Persistence analysis CrowdStrike Endpoint detection & response (EDR)

Return to the full story ←

Checking what ran on the endpoint

Viewed history

Ask about my work.