Bypassing Cylance: Part 4 – Metasploit Meterpreter & PowerShell Empire Agent

Summary

This article, part four of a series, details techniques for achieving command and control (C2) communication within a Cylance-protected environment. It specifically focuses on bypassing Cylance using Metasploit's Meterpreter and PowerShell Empire as agents.

IFF Assessment

FOE

The article describes methods for bypassing security software, which represents a challenge for defenders.

Defender Context

This article highlights advanced techniques for bypassing endpoint detection and response (EDR) solutions like Cylance, which is crucial for defenders to understand. It underscores the ongoing cat-and-mouse game between security vendors and attackers, emphasizing the need for continuous adaptation of defensive strategies and awareness of offensive toolkits like Metasploit and PowerShell Empire.

Read Full Story →