+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Is there anyway to know if a computer is being monitored by EDR (/showthread.php?tid=6282654)
Is there anyway to know if a computer is being monitored by EDR - Skidsuper - Oct 17, 2024
EDR (Endpoint Detection and Response) is a cybersecurity solution that monitors and responds to threats on endpoints, such as computers or devices, in real-time. Does anyone know if there is a way to know if a computer that you are using is being monitored by EDR.
RE: Is there anyway to know if a computer is being monitored by EDR - Charlie Sheen - Oct 17, 2024
Perhaps finding an unknown process in task manager. Monitor network traffic.
RE: Is there anyway to know if a computer is being monitored by EDR - Pimping - Oct 17, 2024
I think you would know if an EDR is running on your pc as there is alerts
also EDRs are made for business/corporations and expensive. usually are not made for normal users
RE: Is there anyway to know if a computer is being monitored by EDR - Riggs - Oct 17, 2024
A lot of EDR agents deployed on user devices are intentionally hidden from user view with tamper protection controls enabled. Depending on if you have local admin to the device, you could try looking in task manager, looking at running processes, or run wireshark and look for any network comms coming to/from to the EDR server to the agent. Maybe also the event viewer security logs.
RE: Is there anyway to know if a computer is being monitored by EDR - Bastille - Oct 18, 2024
Of course :
- check the appwiz.cpl
- check the registry :
> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- check the running processes :
> process hacker
> process monitor (sysinternal)
> process explorer (sysinternal)
- Wireshark / Glasswire / Portmaster (for any network traffic)
RE: Is there anyway to know if a computer is being monitored by EDR - Py_Dev - Oct 18, 2024
use process xp. Check for dll hooks.
RE: Is there anyway to know if a computer is being monitored by EDR - Money- - Oct 19, 2024
It really depends on what type of EDR though. They are many types out there. Some are even just honeypot setups and they have EDR configured to it too to test stuffs and all.
RE: Is there anyway to know if a computer is being monitored by EDR - TheShadowArmy - Nov 10, 2024
(Oct 17, 2024 06:49 PM)Skidsuper Wrote: EDR (Endpoint Detection and Response) is a cybersecurity solution that monitors and responds to threats on endpoints, such as computers or devices, in real-time. Does anyone know if there is a way to know if a computer that you are using is being monitored by EDR.
I did some research and I found that if you are using Windows or Mac you can check your task manager for processes like:
csagent.exe, falconservice.exe for crowdstrike.
cb.exe, cbcomms.exe for carbon black
SentinelAgent.exe for SentinelOne.
MsSense.exe For MS Defender.
You can also check your network traffic for IP addresses associated with EDR with Win + R "resmon"
Look for the network tab and for the Process and Network Activity section and it should show process names along with their PID and their total network usage, you can then view the TCP Connections under the processes to see the IP, port and process names associated with that process, you should look for processes that I mentioned above by the way.
RE: Is there anyway to know if a computer is being monitored by EDR - kazuma - Nov 11, 2024
EDR really should get buzz word of the year. using wireshark would be the most basic way to try identify anything suspicious happening over the network.
RE: Is there anyway to know if a computer is being monitored by EDR - Skidsuper - Nov 16, 2024
(Nov 10, 2024 12:21 PM)TheShadowArmy Wrote: I did some research and I found that if you are using Windows or Mac you can check your task manager for processes like:
csagent.exe, falconservice.exe for crowdstrike.
cb.exe, cbcomms.exe for carbon black
SentinelAgent.exe for SentinelOne.
MsSense.exe For MS Defender.
You can also check your network traffic for IP addresses associated with EDR with Win + R "resmon"
Look for the network tab and for the Process and Network Activity section and it should show process names along with their PID and their total network usage, you can then view the TCP Connections under the processes to see the IP, port and process names associated with that process, you should look for processes that I mentioned above by the way.
Thank you this could be helpful. Are there ways to install video games in the computer without alerting EDR.
RE: Is there anyway to know if a computer is being monitored by EDR - DramaKing - Nov 16, 2024
(Nov 16, 2024 08:49 AM)Skidsuper Wrote: Thank you this could be helpful. Are there ways to install video games in the computer without alerting EDR.
EDR does not normally trigger alerts if video games are present.
RE: Is there anyway to know if a computer is being monitored by EDR - Skidsuper - Nov 16, 2024
(Nov 16, 2024 09:46 AM)DramaKing Wrote: EDR does not normally trigger alerts if video games are present.
Does it not monitor every new software installed?
RE: Is there anyway to know if a computer is being monitored by EDR - DramaKing - Nov 16, 2024
(Nov 16, 2024 12:22 PM)Skidsuper Wrote: Does it not monitor every new software installed?
I didn't say that EDR doesn't monitor and log software installations, just that it wouldn't generate alerts for legitimate software. Now if you're intending to game on a company computer, you have other things to worry about.
RE: Is there anyway to know if a computer is being monitored by EDR - Lzz00 - Dec 9, 2024
EDR does not normally trigger alerts if video games are present.