Comment on Many such cases
Lumilias@pawb.social 4 months ago
On the enterprise side, we use McAfee/Trellix and we’re pretty much glued to them for endpoint security. Why? Nobody else allows you to write custom YARA rules straight to the IPS engine like Trellix does.
Every other vendor only allows you to use rules they have defined for you and doesn’t give you that low level access. It’s frustrating because their support is dogshit too, but my company has niched itself into a corner.
theotterone@lemmy.world 4 months ago
Only run as an experiment myself but Wazuh can do it apparently: …wazuh.com/…/detect-malware-yara-integration.html
MDE can do something similar but you’ll need to rewrite your rules which is of course more than suboptimal… learn.microsoft.com/…/advanced-hunting-overview?v…
Lumilias@pawb.social 4 months ago
Interesting, never heard of Wazuh until now. That looks closer to what Trellix allows.
The guy in charge of picking endpoint security products (whose team writes these rules) has tried Defender and found it lacking in comparison. Also, that link is about historical search for threat hunting, so I’m not sure if it’s the correct one.