#Endpoint Security
All CosmicBytez Labs articles tagged #Endpoint Security, across news, security advisories, how-to guides, and projects.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- News
New Windows Defender Zero-Day Blocks Microsoft Antivirus Updates
Researcher Abdelhamid Naceri released BigDiskBuster, a zero-day that freezes Windows Defender signature and platform updates indefinitely.
- News
New CrowdStrike 'FalconFlank' Zero-Day Grants SYSTEM Privileges
A researcher released a Falcon Sensor zero-day that abuses macro remediation to spawn SYSTEM shells on fully patched Windows 11 and Server 2025.
- News
Named Pipes Under Attack: Securing Windows Interprocess Communication
Weak access controls on Windows named pipes let untrusted processes reach privileged services. Here's how endpoint verification and strict ACLs help.
- News
Endpoint Security Firm Glow Launches With $180M in Funding at $1.2B Valuation
AI-native endpoint security startup Glow has launched from stealth with $180M in Series A funding and a $1.2B valuation. The firm uses environment...
- News
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service operation distributes a sophisticated EDR-killing toolkit called GentleKiller to affiliates, capable of terminating...
- News
Gentlemen Ransomware Uses Multiple EDR Killers to Disable Defenses
The Gentlemen ransomware-as-a-service operation is actively developing and maintaining a suite of EDR killer tools to help affiliates evade detection and...
- News
Endpoint Security Startup Ent Emerges From Stealth With $100 Million Seed Round
Ent, a new endpoint security startup, has announced a landmark $100 million seed round and an intent-aware security platform that intercepts risky user...
- HOWTO
Osquery Endpoint Visibility & Threat Hunting
Use SQL to query your endpoints like a database. Deploy osquery across Linux and Windows hosts to surface process trees, network connections, user activity…
- HOWTO
EDR for SMBs: What It Actually Does, and Why Your Antivirus Isn't Enough
Endpoint Detection and Response is the single most important cybersecurity upgrade most Canadian SMBs can make in 2026. Here's what EDR actually does…
- HOWTO
Velociraptor DFIR Setup, Hunts, and Forensic Collection
Deploy Velociraptor for endpoint visibility, run fleet-wide hunts, collect forensic artifacts, and accelerate incident response with VQL queries.
- News
Trend Micro Warns of Apex One Zero-Day Exploited in the Wild
Trend Micro has patched an Apex One zero-day vulnerability actively exploited in attacks targeting Windows systems. The flaw, discovered in the company's...
- News
Microsoft Warns of New Defender Zero-Days Exploited in Attacks
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
- HOWTO
Sysmon and Windows Event Forwarding: Enterprise-Grade
Deploy Sysmon for deep process, network, and file telemetry, then centralise those events to a Windows Event Collector server using WEF — all without a...
- News
Payouts King Ransomware Uses QEMU Virtual Machines to Bypass Endpoint Security
The Payouts King ransomware group is deploying the QEMU open-source emulator as a covert reverse SSH backdoor, spinning up hidden virtual machines on...
- Project
Velociraptor DFIR: Endpoint Forensics and Incident Response
Deploy Velociraptor — the open-source DFIR platform — to collect forensic artifacts, run live endpoint hunts with VQL, and build an incident response...
- Checklist
Endpoint Security Baseline: Windows 11 + Intune
Comprehensive endpoint security baseline template for Windows 11 devices managed by Microsoft Intune. Covers OS hardening, compliance policies, BitLocker,...
- News
Reynolds Ransomware Embeds BYOVD Driver to Disable EDR
A new ransomware strain called Reynolds bundles a Bring Your Own Vulnerable Driver component directly in its payload, killing EDR processes from...
- HOWTO
Microsoft Defender for Endpoint: Configuration and Hardening
Deploy and configure Microsoft Defender for Endpoint. Covers onboarding methods, ASR rules, network protection, EDR in block mode, and automated investigation.
- HOWTO
SentinelOne Agent Deployment: EDR Installation Guide
Deploy and manage SentinelOne EDR agents across your environment. Covers manual installation, verification, troubleshooting, and best practices.
- Project
SentinelOne Complete Deployment Guide
Full deployment lifecycle for SentinelOne EDR - agent rollout, policy configuration, exclusions, threat hunting queries, and response playbooks.