This is pretty good - detecting Microsoft Recall misuse for data exfil. https://youtu.be/SV9-dn-5uEY?si=jVz9sC4A2wKxeiBt
I tested this against the latest release of Recall and both TotalRecall and these detections still work.
Obviously Recall may well alter before it hits Insider preview channel, nobody needs to rush out detections yet.
Btw all through this saga, Microsoft Defender never triggered Recall specific alerts for me. Sophos did.
Kevin Beaumont /
npub1lc…6lcye
2024-06-15 00:10:59
in reply to nevent1q…l4dc
Author Public Key
npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcyePublished at
2024-06-15 00:10:59Event JSON
{
"id": "a220ea88ae0993aeb955d97b27a6c7d3f45939b2955e87a57ebe24dd59249684",
"pubkey": "fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd",
"created_at": 1718410259,
"kind": 1,
"tags": [
[
"e",
"2fa94d1259a2dbadec0369ddcb04bfd4726a3c12ff7f20a42255b8af27cbc883",
"",
"reply"
],
[
"p",
"6d616d61fb22eda11b57c49b5da5490d57a6fc6b621a565356f06297ae132345"
],
[
"p",
"c3b3d70109b2ca12011df22d4265791d650bca6925d6beb03a5c8d7e052eedce"
],
[
"proxy",
"https://cyberplace.social/@GossiTheDog/112617734794694036",
"web"
],
[
"p",
"18cb19b2c1f2f238767b48234ed02ecbd511eb012a43540e529d642582bf59d5"
],
[
"p",
"706a8260a6dda46fbd813076c7df7072a9c25d8e9927974e9b1c8f0d6987b735"
],
[
"e",
"86e9f5471fcd6ab83a7544379cb34c1fae875159f8bab70d79ade797b20066eb",
"",
"root"
],
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"p",
"51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768"
],
[
"p",
"0b49afa8ec4afd59f5544c06ab5730e1c99c74669de67bbddbd7a0dd265356aa"
],
[
"p",
"d618d58712fc2e53455a1cbd6ae99cce95b08d229ac893ff97baa8e7082f500d"
],
[
"proxy",
"https://cyberplace.social/users/GossiTheDog/statuses/112617734794694036",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://cyberplace.social/users/GossiTheDog/statuses/112617734794694036",
"pink.momostr"
]
],
"content": "This is pretty good - detecting Microsoft Recall misuse for data exfil. https://youtu.be/SV9-dn-5uEY?si=jVz9sC4A2wKxeiBt\n\nI tested this against the latest release of Recall and both TotalRecall and these detections still work. \n\nObviously Recall may well alter before it hits Insider preview channel, nobody needs to rush out detections yet. \n\nBtw all through this saga, Microsoft Defender never triggered Recall specific alerts for me. Sophos did.",
"sig": "18be27d6e6a2a1a8ad0ca1b4c1ec215377733277e2be4bbdbfb063244245062cc1e9f4a7baf2419b583b0b10e7ec6742afa30f1794f1e50a3d7effffe1c52e5f"
}