HiveNightmare aka SeriousSAM vulnerability query
The Live Discover query below, from Sophos MTR, will identify processes that have accessed either the SAM, SECURITY, or SYSTEM Registry hive files in Shadow volumes.
It is optimized to minimize the number of accesses to the Sophos File Journal to enable…
Checking For Print Spooler Vulnerabilities
This query will search your endpoints for the following CVEs and their currently released patches: 2021-1675, 2021-34527, and 2021-34481.
As of writing this, CVE-2021-34481 is considered still vulnerable and the recommended fix is to disable the print…
Check IP Journal against File Properties & Processes
It may be useful to see what specific PID, program, syntax, etc and its threat scoring that has interacted with a specific IP. This is the final query from the Getting Started Recommended Read shared recently.
## DEFINE $$IPaddress$$ as IPaddress
…
Getting Started In Live Discover - From Beginner to Advanced Query Creation
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Table of Contents
Background
Prerequisites
Guide
Intro…
Sophos Rapid Response team sharing their EDR queries on GitHub
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Hi everyone,
The Sophos Rapid Response service is essentially the…
Best Practices On Using Live Discover & Response Query Forum
Disclaimer : This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment. If Sophos-provided pre-defined queries aren’t working, Sophos Support…
Sophos XDR and EDR 4.0 Now Available
We are pleased to announce that today, May 19, we have released some exciting updates for all customers using Sophos EDR (Endpoint Detection and Response) with Intercept X Advanced with EDR and Intercept X Advanced for Server with EDR.
What’s new? …