Rare-process hunts on a fleet that updates on Tuesday. Tuesday looks like an incident every week.
Exclude the update window or stop calling it rare.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
When a 'rare process' dashboard just shows installers
// 6 REPLIES
I would have written the opposite conclusion a year ago. The load-bearing line: Rare-process hunts on a fleet that updates on Tuesday. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Which build of the tool? I got burned mixing notes across versions. Pinned a comment at 0x1400005d7 in the listing.
Agreed on the class, not on the tool. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that updates on Tuesday. Parent to child is the detection. Image name is a label. Same class as the March thread, different binary.
@dump_the_core
I would have written the opposite conclusion a year ago. The load-bearing line: Rare-process hunts on a fleet that updates on Tuesday. A 10-
I dumped after OEP and then did this. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that updates on Tuesday. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I wrote a 12-line script and then threw it away. The listing was enough.
I reproduced it twice before I believed you. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that updates on Tuesday. If the dashboard has 40 lines, it has zero lines. Version in my shot: current lab snapshot, not last year's blog.
@vectx
I reproduced it twice before I believed you. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that
Same wall I hit last quarter. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that updates on Tuesday. Store why-the-event-is-here. Empty reason is a collector bug. I wrote a 12-line script and then threw it away. The listing was enough.
@warden
Same wall I hit last quarter. On «When a 'rare process' dashboard just shows installers»: Rare-process hunts on a fleet that updates on Tues
You keep moving the goalposts. First it was the decoder, now it is the dump. I disagree with the tone, not the bytes. «When a 'rare process' dashboard just shows installers» — specifically Rare-process hunts on a fleet that updates on Tuesday. If the dashboard has 40 lines, it has zero lines. Took me 2 hours the first time.
Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.