☁️Cloud Infrastructure Engineer || VMware-VCIX (DCV/NV) | NSX | Aria | vSAN | VDI | HCI | VCF | Dell EMC - ISM | AWS | GCP | Cisco CCNP-DC | Veeam
Here is the workaround for solving #CrowdStrike Blue screen issue: - Boot into Safe Mode or Recovery Environment. - Navigate to “System32\drivers\CrowdStrike directory”. - Locate the file “C-00000291*.sys”, and delete it. - Boot the host normall.
Director & India Head- Modern Apps & Cloud(North America, APAC & EMEA) |Digital Transformation Leader |Prompt Engineering | Metaverse & Blockchain Expert| CSPO|CSM|MCSD|MCP|
How to fix your computer if you are affected by the #crowdstrike crash: 1. Reboot the machine in safe mode 2. Open command prompt with admin credential 3. Run the following command: sc config "csagent" start=disabled 4. Reboot normal #microsoftoutage
How to fix your computer if you are affected by the hashtag #crowdstrike crash: 1. Reboot the machine in safe mode 2. Open command prompt with admin credential 3. Run the following command: sc config "csagent" start=disabled 4. Reboot normal hashtag #microsoftoutage
AI Solutions Engineer / Social Media / Cloud Computing / Platform Engineering / IT Governance, Risk and Compliance / Telecoms Engineer
#CrowdStrike #BSOD > Boot into Safe Mode, "Advanced Startup" with Command Prompt, and use > this command to remove faulty channel files: > > del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys" > >This is a better choice than changing the folder name for the CrowdStrike driver, but as always, YMMV. https://lnkd.in/gzzwYtt8
🥰 What a great tool to audit defenses and help company's to realize AV/EDR is not the last line of defense. What would you do to help your company? Would better logging help your company? #riskassessment #ciso #securityarchitect #detection
How to generate an evasive malicious Clickonce payload with BallisKit tools? By combining ShellcodePack EXE generation feature and MacroPack Pro Clickonce generation feature to drop that EXE. We had very good feedback about this payload including smartscreen and EDR bypass 😎 In the video below the second stage is Mythic C2 with Merlin agent. #redteam
Join ZDI's Brian Gorenc and Dustin Childs for their talk, "Best of the Worst: Misadventures in Bug Disclosure" at RingZer0's Bootloader Mixer the night before #bootstrap24. This talk looks at some of the best of the worst examples of vendor bug disclosure. Disclosing bugs can get contentious. It can also be confusing when a vendor doesn't have a mature response process. Some reports are frustrating, some are comical, and some are absolutely wild. All of them resulted in face palms at multiple levels. We'll go behind the scenes to show the sometimes gory details and laughable farces of bug disclosure. Finally, we'll offer advice to those on the receiving end of disclosure to help them ensure they don't end up in version 2.0 of this talk.
Turning Digital Footprints into Answers: Experienced Forensic Consultant and SANS Certified and SANS Lethal Forensicator
For the current Croudstrike BSOD issue there are a few work around 1. Group policy to remove the file https://lnkd.in/dqzcCM3Z 2. Manually remove the file within Safe Mode, Advanced Start Up (Command Prompt): del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys" The Reddit thread: https://lnkd.in/gy5UPWtg My chatter on Twitter: https://lnkd.in/gXFkGWNV Try the above in a test environment prior to running it in production.
From the Twitters regarding #CrowdStrike outage. Please type 'F' in the chat for all the #SysAdmins out there today dealing with this mess. (Have heard anecdotes that up to 15 reboots can cause the OS to remove the faulty file automatically. Unconfirmed.)
