Hacker News new | ask | show | jobs
by technion 2354 days ago
True, but imagine you deployed SEP in accordance with supplier's instructions:

https://support.symantec.com/us/en/article.tech237177.html

Or Mcafee:

https://kc.mcafee.com/corporate/index?page=content&id=KB8245... (search for DisableRealtimeMonitoring)

For a deeper dive: I ran into issues on a security assessment trying to run procdump on lsass being blocked by Defender. Workaround.. was to find a machine with McAfee installed where that behavior was allowed.