search

mitre / sandcat

A CALDERA plugin
https://caldera.mitre.org/
Apache License 2.0
60 stars 36 forks source link

Sandcat AV removal #426

Closed UMWP closed 1 year ago

UMWP commented 1 year ago

How can I deploy sandcat agent on remote windows machine while AV (ESET or Windows Defender) doesn't allow it. I have go lang installed on caldera: root@caldera:~# go version go1.18.1 lunux/amd64

Any ideas?

elegantmoose commented 1 year ago

@UMWP Yes, we deal with this issue a lot ourselves as sandcat is well known now. Our approach is to generally pursue security policy exceptions, obviously solution mileage may vary depending on target environment and ability to enable such exception policies.