Epsiode 13 | Weaponizing Defensive Technologies

What does it actually take to change an attacker's behavior, not just detect it? In this episode, Jose and Mike sit down with Devon Kerr, Principal Threat Researcher at Huntress, to break down what weaponizing defensive technologies actually looks like in practice. Devon walks through the three legs of the stool: intra-process controls, network manipulation, and deception technologies. Not as individual tools, as a system. Throttle a backdoor's throughput just enough that the attacker can still resolve Google.com but their beaconing crawls. Now they're questioning their code, their infrastructure, whether they've been caught. That question eats time. And they operate under pressure. The episode also covers why blocking an IP address or sinkholing a domain is performative, it tells the attacker exactly what happened and forces them to adapt. And why the narrative that defenders have to be right 100% of the time is no longer accurate when you're manipulating the adversary's conditions. Plus, sixteen pull requests from seven contributors landed this week across LOLBAS, HijackLibs, LOLRMM, and LOLDrivers. The community is keeping this alive. 🔗 MagicSword is free for up to 100 endpoints, get started here: https://www.magicsword.io/dashboard/s... 🚀 Ready for More? Go Enterprise. Enterprise unlocks unlimited endpoints, 90+ days of data retention, and a much deeper feature set. Book a demo: https://www.magicsword.io/book-demo #PreventionEngineering #CyberSecurity #ThreatHunting #DeceptionTechnology #MagicSword #BlueTeam #DetectionEngineering #Huntress #ApplicationControl #EndpointSecurity