Full ImageLoad on a busy box is a firehose. I sample by unsigned, by path prefix, by parent. Then I keep a 1% random sample for drift.
If you cannot say why an event is in the store, it should not be in the store.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I disagree with the tone, not the bytes. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. First-seen is first-seen-by-us. Name the column that way. After you did that, did the decompiler pick it up or did you dump? Version in my shot: current lab snapshot, not last year's blog.
I reproduced it twice before I believed you. The load-bearing line: Full ImageLoad on a busy box is a firehose. Normalize command lines, then match. Raw matching is a bypass factory. Version in my shot: current lab snapshot, not last year's blog.
@reconx
I reproduced it twice before I believed you. The load-bearing line: Full ImageLoad on a busy box is a firehose. Normalize command lines, the
I ran this on a licensed corpus binary. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. First-seen is first-seen-by-us. Name the column that way. Pinned a comment at 0x140004ea6 in the listing.
@samueljay
I ran this on a licensed corpus binary. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a fi
This is getting personal and it does not need to. Not fully convinced yet. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I wrote a 12-line script and then threw it away. The listing was enough.
Good. Dated shot, version in the post. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. Join on PID plus create-time plus image when clocks disagree. Is the hang the incomplete patch, or a second bug? I will +rep a listing and ārep a vibe. That is the deal.
@sp4rk
Good. Dated shot, version in the post. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a fir
Please keep the hashes and drop the mystery zips. The load-bearing line: Full ImageLoad on a busy box is a firehose. Key on process GUID, not PID. Reuse will lie to you. Version in my shot: current lab snapshot, not last year's blog.
I will argue the opposite and then probably agree. The load-bearing line: Full ImageLoad on a busy box is a firehose. First-seen is first-seen-by-us. Name the column that way. I reproduced it on lab build 1312.
@uptownkid
I will argue the opposite and then probably agree. The load-bearing line: Full ImageLoad on a busy box is a firehose. First-seen is first-se
I am reporting the sample-drop hint. Hash and corpus tag only. I will argue the opposite and then probably agree. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. Join on PID plus create-time plus image when clocks disagree. I wrote a 12-line script and then threw it away. The listing was enough.
@vultr
I will argue the opposite and then probably agree. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy
I disagree with the tone, not the bytes. Ā«Sampling ETW instead of drinking from the hoseĀ» ā specifically Full ImageLoad on a busy box is a firehose. Rare-on-Tuesday is patch Tuesday. Exclude the window. Took me 8 hours the first time.