process(guid, image, parent_guid, ts). net(guid, dst, ts). file(guid, path, ts). That is the schema. Postgres later, maybe never.
Lab is not production. SQLite is allowed.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I still keep a paper notebook for this kind of note. «A tiny SQLite schema for lab telemetry that I will not 'scale'» — specifically process(guid, image, parent_guid, ts). Join on PID plus create-time plus image when clocks disagree. Hash of the public file, or are we arguing a shape? Same class as the March thread, different binary.
@zero
Not fully convinced yet. On «A tiny SQLite schema for lab telemetry that I will not 'scale'»: process(guid, image, parent_guid, ts). Rare-on
If you cannot paste bytes, you do not have a counterexample. I want the listing, not the decompiler story. The load-bearing line: process(guid, image, parent_guid, ts). Parent to child is the detection. Image name is a label. I still have the snapshot named anal-146-pre.
I would have written the opposite conclusion a year ago. The load-bearing line: process(guid, image, parent_guid, ts). Normalize command lines, then match. Raw matching is a bypass factory. I still have the snapshot named anal-146-pre.
@secbit
I would have written the opposite conclusion a year ago. The load-bearing line: process(guid, image, parent_guid, ts). Normalize command lin
Stop flexing an IDA license. The question was the unwind info. If you only have the decompiler, you do not have the bug. On «A tiny SQLite schema for lab telemetry that I will not 'scale'»: process(guid, image, parent_guid, ts). Lead with image/path/signer, not SHA256. Humans cannot read hashes. I will +rep a listing and −rep a vibe. That is the deal.
I dumped after OEP and then did this. «A tiny SQLite schema for lab telemetry that I will not 'scale'» — specifically process(guid, image, parent_guid, ts). Normalize command lines, then match. Raw matching is a bypass factory. I still have the snapshot named anal-146-pre.
@stackx
I dumped after OEP and then did this. «A tiny SQLite schema for lab telemetry that I will not 'scale'» — specifically process(guid, image, p
Calling the sticky 'priest talk' is how you earn a ban note. The screenshot is the useful part of the post. You wrote «process(guid, image, parent_guid, ts)». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. Did page heap see it, or only the sanitizer? If anyone DMs me a zip I will not open it. Hash in-thread.
@thndr
The screenshot is the useful part of the post. You wrote «process(guid, image, parent_guid, ts)». That is the sentence I keep. Normalize com
Same wall I hit last quarter. The load-bearing line: process(guid, image, parent_guid, ts). First-seen is first-seen-by-us. Name the column that way. I still have the snapshot named anal-146-pre.
@vibeking
Same wall I hit last quarter. The load-bearing line: process(guid, image, parent_guid, ts). First-seen is first-seen-by-us. Name the column
That is a vibe. I asked for a listing offset. This matches a public n-day class from last patch Tuesday. «A tiny SQLite schema for lab telemetry that I will not 'scale'» — specifically process(guid, image, parent_guid, ts). Lead with image/path/signer, not SHA256. Humans cannot read hashes. Took me 4 hours the first time.
Not fully convinced yet. On «A tiny SQLite schema for lab telemetry that I will not 'scale'»: process(guid, image, parent_guid, ts). Rare-on-Tuesday is patch Tuesday. Exclude the window. My note id for this: 92-06.