Tim Brigham OC

Ok, these are from the full operation report. For reference, this came from operation "Engagement 2 Lateral Movement (5/24/2024, 9:03:54 AM)" ``` "facts": [ { "unique": "domain.user.nameMYACCOUNT", "trait": "domain.user.name", "name":...

I love how interactive this community has been in getting bug reports! Thanks @guillaume-duong-bib Could you kindly explain how you got your screenshot for the "saved to disk" relationships? I...

Thanks @guillaume-duong-bib. I'll definitely look into doing reading that file. I would dearly love to see detailed logging regarding when and how facts are used when turning the server process...

I have seen this same behavior, Windows 11, Chrome 124

It looks like something in the network traffic getting mangled can drive the CPU utilization to maximum, resulting in this issue.. Restarting the caldera server process corrects it. Not sure...

So almost immediately after posting this issue, I believe I have found the underlying cause. For the Intune publisher string returned by `Get-AppLockerFileInformation` the structure of the 'Publisher' line of...

Thanks to everyone on the responses here. The managed installer functionality here might still be useful, if we can get an appropriate whitelist configuration in place for which packages are...

Yeah, I could see that being a limiting factor. It's only (unusably) sluggish when there is an active operation and a bunch of historical data. I'm pretty sure my memory...