Sly | Dune

I am nearly certain that even mid tier EDR would’ve caught this tbh. We will have to wait for forensics but I have no reason to think otherwise. It’s worth unpacking what EDR is though bc I think you are confused. EDR focuses on runtime, not checking X against Y. It doesn’t matter if every single repo and hash is unknown or if you choose to run something. It’s still going to light up like a fucking Christmas tree. Bc the shit that you’re doing when you run that repo looks like this: > VS Code launched node.js, which spawned bash, which ran curl, to download a binary, which then opened a connection to a C2 server, and created a new hidden file in an hidden directory, which sets persistence, and then began poking every browser credential and crypto wallets and keychain data, all while sending encrypted payloads to this unknown raw IP it’s never seen before every 60 secs on repeat forever, all in the same 5 minute span under the same process. Yes, every single one of those things is going to be detected and flagged. Especially persistence. Especially shit suddenly poking every place secrets are stored. Especially the calls to a random ass IP. If you insist on setting up your airgapped device, you can absolutely do so. Be my guest. But when you end up turning the internet on bc you can fucking sign the txn then you best make damn fucking sure the first thing you do is EDR that bitch up.