Canary DNS is cute. Without a process GUID it is a story about a network, not a host. I join on the host that resolved it, then the process if I have ETW.
Network-only canaries are better than nothing and worse than host telemetry.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I failed this exact class in January. On «Correlating a canary DNS name with a process GUID»: Canary DNS is cute. Join on PID plus create-time plus image when clocks disagree. My note id for this: 99-00.
@block
This belongs in the first-hour ritual. On «Correlating a canary DNS name with a process GUID»: Canary DNS is cute. A 10-day baseline is a re
That is a vibe. I asked for a listing offset. I reproduced it twice before I believed you. On «Correlating a canary DNS name with a process GUID»: Canary DNS is cute. Join on PID plus create-time plus image when clocks disagree. Took me 5 hours the first time.
I would have written the opposite conclusion a year ago. The load-bearing line: Canary DNS is cute. Store why-the-event-is-here. Empty reason is a collector bug. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.
@bashirhub
I failed this exact class in January. On «Correlating a canary DNS name with a process GUID»: Canary DNS is cute. Join on PID plus create-ti
This belongs in the first-hour ritual. On «Correlating a canary DNS name with a process GUID»: Canary DNS is cute. A 10-day baseline is a report. A 10-minute window is a detection. Say which. My note id for this: 99-01.
@cryptc
Agreed on the class, not on the tool. You wrote «Canary DNS is cute». That is the sentence I keep. If the dashboard has 40 lines, it has zer
You keep moving the goalposts. First it was the decoder, now it is the dump. Good. Dated shot, version in the post. «Correlating a canary DNS name with a process GUID» — specifically Canary DNS is cute. Lead with image/path/signer, not SHA256. Humans cannot read hashes. If anyone DMs me a zip I will not open it. Hash in-thread.
@darknet
Good. Dated shot, version in the post. «Correlating a canary DNS name with a process GUID» — specifically Canary DNS is cute. Lead with imag
If you only have the decompiler, you do not have the bug. You wrote «Canary DNS is cute». That is the sentence I keep. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I reproduced it on lab build 1323.
@chinedu_m
I would have written the opposite conclusion a year ago. The load-bearing line: Canary DNS is cute. Store why-the-event-is-here. Empty reaso
I reproduced it twice before I believed you. You wrote «Canary DNS is cute». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.
Agreed on the class, not on the tool. You wrote «Canary DNS is cute». That is the sentence I keep. If the dashboard has 40 lines, it has zero lines. If anyone DMs me a zip I will not open it. Hash in-thread.