Pages
(Move to ...)
Home
All Things Symantec
All Things OneDrive
Tools
▼
Showing posts with label
SEP
.
Show all posts
Showing posts with label
SEP
.
Show all posts
Monday, May 3, 2021
SEPparser Released
›
What is SEPparser? SEPparser is a command line tool examine artifacts from Symantec Endpoint Protection (SEP). SEPparser can be ran against ...
Tuesday, March 30, 2021
Your AV is Trying to Tell You Something: Registry
›
registry_keys.md What research is complete without looking at the registry. ...
Tuesday, March 23, 2021
Your AV is Trying to Tell You Something: Submission Engine
›
ccSubSDK "Symantec Endpoint Protection clients automatically submit pseudonymous information about detections, network, and configurati...
Tuesday, March 16, 2021
Your AV is Trying to Tell You Something: VBN's Part 4
›
In this post, we will cover record type 1 VBN's. This will be fairly short because there is not much to these types of VBN's. They c...
Tuesday, March 9, 2021
Your AV is Trying to Tell You Something: VBN's Part 3
›
This post will focus on record type 0 VBN's. Record type 0 VBN's also contain quarantine data. I recently discovered these files whi...
Tuesday, March 2, 2021
Your AV is Trying to Tell You Something: VBN's Part 2
›
From the previous post, we learned that there are three VBN record types. I want to start with record type 2 because this is what people thi...
›
Home
View web version
