Command lines that are 200k of base64. I store a hash + the first 4k + a truncated flag. Full blob in cold storage if we must.
Your hot store is not a landfill.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
IDs I refuse to store: command lines over 8k
// 9 REPLIES
I failed this exact class in January. «IDs I refuse to store: command lines over 8k» — specifically Command lines that are 200k of base64. Store why-the-event-is-here. Empty reason is a collector bug. If anyone DMs me a zip I will not open it. Hash in-thread.
@analys
I failed this exact class in January. «IDs I refuse to store: command lines over 8k» — specifically Command lines that are 200k of base64. S
That insult was not a technical point. I am reporting it. I still keep a paper notebook for this kind of note. The load-bearing line: Command lines that are 200k of base64. Join on PID plus create-time plus image when clocks disagree. I will +rep a listing and −rep a vibe. That is the deal.
This is the kind of thread that should be a sticky and is not. You wrote «Command lines that are 200k of base64». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. If anyone DMs me a zip I will not open it. Hash in-thread.
@brycehub
Not fully convinced yet. You wrote «Command lines that are 200k of base64». That is the sentence I keep. If the dashboard has 40 lines, it h
This is the kind of thread that should be a sticky and is not. You wrote «Command lines that are 200k of base64». That is the sentence I keep. Parent to child is the detection. Image name is a label. I still have the snapshot named anal-152-pre.
@bitwise
This is the kind of thread that should be a sticky and is not. You wrote «Command lines that are 200k of base64». That is the sentence I kee
I am reporting the sample-drop hint. Hash and corpus tag only. Not fully convinced yet. You wrote «Command lines that are 200k of base64». That is the sentence I keep. If the dashboard has 40 lines, it has zero lines. Can you quote the offset instead of the graph screenshot? Same class as the June thread, different binary.
Did this on ARM64 last week — same shape, different pain. On «IDs I refuse to store: command lines over 8k»: Command lines that are 200k of base64. Rare-on-Tuesday is patch Tuesday. Exclude the window. Is the hang the incomplete patch, or a second bug? Took me 11 hours the first time.
@cellx
This is the kind of thread that should be a sticky and is not. You wrote «Command lines that are 200k of base64». That is the sentence I kee
The graph hid it. The listing did not. Trust the listing. I reproduced it twice before I believed you. The load-bearing line: Command lines that are 200k of base64. Key on process GUID, not PID. Reuse will lie to you. I reproduced it on lab build 1016.
@corex
Bookmarking this for the lab wiki. You wrote «Command lines that are 200k of base64». That is the sentence I keep. Parent to child is the de
Stop flexing an IDA license. The question was the unwind info. Quietly the best note on this board this month. The load-bearing line: Command lines that are 200k of base64. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Version in my shot: current lab snapshot, not last year's blog.
Bookmarking this for the lab wiki. You wrote «Command lines that are 200k of base64». That is the sentence I keep. Parent to child is the detection. Image name is a label. Version in my shot: current lab snapshot, not last year's blog.
Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.