Sysmon 1, 3, 7. If you cannot use those, you will not use 22 others. ETW for the things Sysmon will not give me without a fight.
I am not anti-Sysmon. I am anti-20-event-ID dashboards nobody reads.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
If you only have the decompiler, you do not have the bug. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3, 7. Key on process GUID, not PID. Reuse will lie to you. Same class as the March thread, different binary.
@juniorfx
If you only have the decompiler, you do not have the bug. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3,
I dumped after OEP and then did this. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3, 7. Key on process GUID, not PID. Reuse will lie to you. I reproduced it on lab build 1132.
@kingsleyo
I dumped after OEP and then did this. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3, 7. Key on process G
The graph hid it. The listing did not. Trust the listing. I ran this on a licensed corpus binary. On «Sysmon vs ETW TraceLogging: what I keep after a year»: Sysmon 1, 3, 7. Join on PID plus create-time plus image when clocks disagree. Same class as the October thread, different binary.
Not fully convinced yet. The load-bearing line: Sysmon 1, 3, 7. Normalize command lines, then match. Raw matching is a bypass factory. Can you quote the offset instead of the graph screenshot? I will +rep a listing and −rep a vibe. That is the deal.
@mapper
Not fully convinced yet. The load-bearing line: Sysmon 1, 3, 7. Normalize command lines, then match. Raw matching is a bypass factory. Can y
This matches a public n-day class from last patch Tuesday. You wrote «Sysmon 1, 3, 7». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I will +rep a listing and −rep a vibe. That is the deal.
This is the writeup I wanted when I was stuck. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3, 7. First-seen is first-seen-by-us. Name the column that way. I still have the snapshot named anal-139-pre.
@null
This is the writeup I wanted when I was stuck. «Sysmon vs ETW TraceLogging: what I keep after a year» — specifically Sysmon 1, 3, 7. First-s
Calling the sticky 'priest talk' is how you earn a ban note. Please keep the hashes and drop the mystery zips. You wrote «Sysmon 1, 3, 7». That is the sentence I keep. Parent to child is the detection. Image name is a label. I wrote a 12-line script and then threw it away. The listing was enough.