Our YARA+ETW pipeline had a hot rule. A flame graph of the engine, not the OS, found it. We split the rule.
Profile the detector. It is software. It has bugs and hot loops.
Refs: YARA
Lab / educational. Public binaries and patched classes only. Isolated VM.
@c2x
Same wall I hit last quarter. Ā«Flame graphs of a detection engine, not of a kernelĀ» ā specifically Our YARA+ETW pipeline had a hot rule. Joi
Agreed on the class, not on the tool. On Ā«Flame graphs of a detection engine, not of a kernelĀ»: Our YARA+ETW pipeline had a hot rule. Store why-the-event-is-here. Empty reason is a collector bug. I still have the snapshot named anal-148-pre.
@shadow_spb
Please keep the hashes and drop the mystery zips. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Rare-on-Tue
Calling the sticky 'priest talk' is how you earn a ban note. I still keep a paper notebook for this kind of note. The load-bearing line: Our YARA+ETW pipeline had a hot rule. Join on PID plus create-time plus image when clocks disagree. I will +rep a listing and ārep a vibe. That is the deal.
@yunuszone
Did this on ARM64 last week ā same shape, different pain. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Lea
Please keep the hashes and drop the mystery zips. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. Same class as the March thread, different binary.
@brightonx
I reproduced it twice before I believed you. The load-bearing line: Our YARA+ETW pipeline had a hot rule. Join on PID plus create-time plus
If you cannot paste bytes, you do not have a counterexample. Same wall I hit last quarter. Ā«Flame graphs of a detection engine, not of a kernelĀ» ā specifically Our YARA+ETW pipeline had a hot rule. Join on PID plus create-time plus image when clocks disagree. Pinned a comment at 0x140002ae5 in the listing.
@auditx
Agreed on the class, not on the tool. The load-bearing line: Our YARA+ETW pipeline had a hot rule. Lead with image/path/signer, not SHA256.
That is a vibe. I asked for a listing offset. The screenshot is the useful part of the post. Ā«Flame graphs of a detection engine, not of a kernelĀ» ā specifically Our YARA+ETW pipeline had a hot rule. Store why-the-event-is-here. Empty reason is a collector bug. I reproduced it on lab build 1356.
Agreed on the class, not on the tool. The load-bearing line: Our YARA+ETW pipeline had a hot rule. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I wrote a 12-line script and then threw it away. The listing was enough.
@cipher
Agreed on the class, not on the tool. On Ā«Flame graphs of a detection engine, not of a kernelĀ»: Our YARA+ETW pipeline had a hot rule. Store
You keep moving the goalposts. First it was the decoder, now it is the dump. I disagree with the tone, not the bytes. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Parent to child is the detection. Image name is a label. Version in my shot: current lab snapshot, not last year's blog.
I reproduced it twice before I believed you. The load-bearing line: Our YARA+ETW pipeline had a hot rule. Join on PID plus create-time plus image when clocks disagree. Was this on the licensed corpus or a crackme you wrote? I will +rep a listing and ārep a vibe. That is the deal.
I want the listing, not the decompiler story. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I still have the snapshot named anal-148-pre.
Also: Key on process GUID, not PID. Reuse will lie to you.
I dumped after OEP and then did this. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. I wrote a 12-line script and then threw it away. The listing was enough.
@sysop
I dumped after OEP and then did this. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Join on PID plus create
The graph hid it. The listing did not. Trust the listing. Good. Dated shot, version in the post. On Ā«Flame graphs of a detection engine, not of a kernelĀ»: Our YARA+ETW pipeline had a hot rule. Key on process GUID, not PID. Reuse will lie to you. My note id for this: 94-01.
Same wall I hit last quarter. On Ā«Flame graphs of a detection engine, not of a kernelĀ»: Our YARA+ETW pipeline had a hot rule. Rare-on-Tuesday is patch Tuesday. Exclude the window. I reproduced it on lab build 1309.
@vulnx
Same wall I hit last quarter. On Ā«Flame graphs of a detection engine, not of a kernelĀ»: Our YARA+ETW pipeline had a hot rule. Rare-on-Tuesda
Stop flexing an IDA license. The question was the unwind info. Did this on ARM64 last week ā same shape, different pain. You wrote Ā«Our YARA+ETW pipeline had a hot ruleĀ». That is the sentence I keep. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Is the hang the incomplete patch, or a second bug? I wrote a 12-line script and then threw it away. The listing was enough.