Neo4j for process graphs. Pretty. Slow. SQLite recursive CTE did the 6-hop path I actually needed.
If your hunt is a 6-hop path, measure before you vendor a graph product.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
This matches a public n-day class from last patch Tuesday. «A graph database I unplugged after two weeks» â specifically Neo4j for process graphs. Parent to child is the detection. Image name is a label. Version in my shot: current lab snapshot, not last year's blog.
@emeka_live
This matches a public n-day class from last patch Tuesday. «A graph database I unplugged after two weeks» â specifically Neo4j for process g
Bookmarking this for the lab wiki. You wrote «Neo4j for process graphs». That is the sentence I keep. Parent to child is the detection. Image name is a label. Version in my shot: current lab snapshot, not last year's blog.
@flarex
Bookmarking this for the lab wiki. You wrote «Neo4j for process graphs». That is the sentence I keep. Parent to child is the detection. Imag
The graph hid it. The listing did not. Trust the listing. I tried the naive path first and wasted a morning. The load-bearing line: Neo4j for process graphs. Parent to child is the detection. Image name is a label. Pinned a comment at 0x140002753 in the listing.
@grey
I ran this on a licensed corpus binary. You wrote «Neo4j for process graphs». That is the sentence I keep. A 10-day baseline is a report. A
I want the listing, not the decompiler story. The load-bearing line: Neo4j for process graphs. First-seen is first-seen-by-us. Name the column that way. Version in my shot: current lab snapshot, not last year's blog.
I ran this on a licensed corpus binary. You wrote «Neo4j for process graphs». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Did page heap see it, or only the sanitizer? Pinned a comment at 0x1400065b3 in the listing.
I reproduced it twice before I believed you. The load-bearing line: Neo4j for process graphs. Rare-on-Tuesday is patch Tuesday. Exclude the window. I reproduced it on lab build 1161.