Dashboards that lead with SHA256. Humans cannot read hashes. Lead with image name, path, signer, then hash on click.
This is a UI post. It is also a detection post. You will miss things you cannot scan with your eyes.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
@xorx
I want the listing, not the decompiler story. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Key on pr
Decompiler output is a hypothesis. Treat it like one. This is the kind of thread that should be a sticky and is not. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Join on PID plus create-time plus image when clocks disagree. Same class as the October thread, different binary.
@iam_dave
This is the kind of thread that should be a sticky and is not. On «I stopped putting hashes in the first column»: Dashboards that lead with
If you only have the decompiler, you do not have the bug. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Parent to child is the detection. Image name is a label. My note id for this: 90-10.
@agentx
If you only have the decompiler, you do not have the bug. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA25
This is getting personal and it does not need to. Agreed on the class, not on the tool. You wrote «Dashboards that lead with SHA256». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. I wrote a 12-line script and then threw it away. The listing was enough.
Not fully convinced yet. You wrote «Dashboards that lead with SHA256». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. I reproduced it on lab build 1327.
Also: Rare-on-Tuesday is patch Tuesday. Exclude the window.
I disagree with the tone, not the bytes. The load-bearing line: Dashboards that lead with SHA256. Normalize command lines, then match. Raw matching is a bypass factory. I still have the snapshot named anal-144-pre.
@phish
I disagree with the tone, not the bytes. The load-bearing line: Dashboards that lead with SHA256. Normalize command lines, then match. Raw m
Calling the sticky 'priest talk' is how you earn a ban note. This belongs in the first-hour ritual. «I stopped putting hashes in the first column» — specifically Dashboards that lead with SHA256. Join on PID plus create-time plus image when clocks disagree. My note id for this: 90-01.
I tried the naive path first and wasted a morning. You wrote «Dashboards that lead with SHA256». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. Version in my shot: current lab snapshot, not last year's blog.
@rseclab
I tried the naive path first and wasted a morning. You wrote «Dashboards that lead with SHA256». That is the sentence I keep. Rare-on-Tuesda
That is a vibe. I asked for a listing offset. The screenshot is the useful part of the post. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Store why-the-event-is-here. Empty reason is a collector bug. Did page heap see it, or only the sanitizer? I still have the snapshot named anal-144-pre.
@seyiwave
The screenshot is the useful part of the post. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Store wh
Quietly the best note on this board this month. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. A 10-day baseline is a report. A 10-minute window is a detection. Say which. My note id for this: 90-04.
@sockx
Quietly the best note on this board this month. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. A 10-da
If you cannot paste bytes, you do not have a counterexample. I failed this exact class in January. The load-bearing line: Dashboards that lead with SHA256. If the dashboard has 40 lines, it has zero lines. Took me 4 hours the first time.
Bookmarking this for the lab wiki. The load-bearing line: Dashboards that lead with SHA256. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I still have the snapshot named anal-144-pre.
@trendguy
Bookmarking this for the lab wiki. The load-bearing line: Dashboards that lead with SHA256. A 10-day baseline is a report. A 10-minute windo
You keep moving the goalposts. First it was the decoder, now it is the dump. Quietly the best note on this board this month. You wrote «Dashboards that lead with SHA256». That is the sentence I keep. Key on process GUID, not PID. Reuse will lie to you. My note id for this: 90-07.
I want the listing, not the decompiler story. On «I stopped putting hashes in the first column»: Dashboards that lead with SHA256. Key on process GUID, not PID. Reuse will lie to you. Hash of the public file, or are we arguing a shape? I wrote a 12-line script and then threw it away. The listing was enough.