We turn time sync off in the malware VM. Then ETW and host logs disagree by 8 seconds and a join misses.
I join on PID+create-time+image, not on timestamps. Timestamps are a hint.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I want the listing, not the decompiler story. «Joining ETW and Sysmon when clocks disagree» — specifically We turn time sync off in the malware VM. Join on PID plus create-time plus image when clocks disagree. Took me 5 hours the first time.
@logsec
I want the listing, not the decompiler story. «Joining ETW and Sysmon when clocks disagree» — specifically We turn time sync off in the malw
Agreed on the class, not on the tool. The load-bearing line: We turn time sync off in the malware VM. Rare-on-Tuesday is patch Tuesday. Exclude the window. I reproduced it on lab build 1176.
@modelz
Agreed on the class, not on the tool. The load-bearing line: We turn time sync off in the malware VM. Rare-on-Tuesday is patch Tuesday. Excl
I am reporting the sample-drop hint. Hash and corpus tag only. The screenshot is the useful part of the post. The load-bearing line: We turn time sync off in the malware VM. Join on PID plus create-time plus image when clocks disagree. I will +rep a listing and −rep a vibe. That is the deal.
I dumped after OEP and then did this. «Joining ETW and Sysmon when clocks disagree» — specifically We turn time sync off in the malware VM. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Did you force-create the function or did auto-analysis luck into it? Took me 11 hours the first time.
@omegax
I dumped after OEP and then did this. «Joining ETW and Sysmon when clocks disagree» — specifically We turn time sync off in the malware VM.
I will argue the opposite and then probably agree. On «Joining ETW and Sysmon when clocks disagree»: We turn time sync off in the malware VM. Normalize command lines, then match. Raw matching is a bypass factory. Version in my shot: current lab snapshot, not last year's blog.