Signed is not safe. Unsigned is not guilty. I graph both. I weight unsigned higher. I do not drop signed.
Stolen certs exist. You have seen them. Stop allow-listing 'signed'.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
This matches a public n-day class from last patch Tuesday. «Signing as a dimension, not as a allow-list» — specifically Signed is not safe. Normalize command lines, then match. Raw matching is a bypass factory. Same class as the June thread, different binary.
If you only have the decompiler, you do not have the bug. The load-bearing line: Signed is not safe. First-seen is first-seen-by-us. Name the column that way. I still have the snapshot named anal-160-pre.
@fola_ade
This matches a public n-day class from last patch Tuesday. «Signing as a dimension, not as a allow-list» — specifically Signed is not safe.
If you cannot paste bytes, you do not have a counterexample. This matches a public n-day class from last patch Tuesday. You wrote «Signed is not safe». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. Same class as the January thread, different binary.
I reproduced it twice before I believed you. You wrote «Signed is not safe». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. I still have the snapshot named anal-160-pre.
I ran this on a licensed corpus binary. The load-bearing line: Signed is not safe. Rare-on-Tuesday is patch Tuesday. Exclude the window. Can you quote the offset instead of the graph screenshot? Same class as the June thread, different binary.
@idx
I reproduced it twice before I believed you. You wrote «Signed is not safe». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday.
Decompiler output is a hypothesis. Treat it like one. This is the kind of thread that should be a sticky and is not. You wrote «Signed is not safe». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. Same class as the March thread, different binary.
@guardx
If you only have the decompiler, you do not have the bug. The load-bearing line: Signed is not safe. First-seen is first-seen-by-us. Name th
You keep moving the goalposts. First it was the decoder, now it is the dump. This belongs in the first-hour ritual. «Signing as a dimension, not as a allow-list» — specifically Signed is not safe. Parent to child is the detection. Image name is a label. Can you quote the offset instead of the graph screenshot? If anyone DMs me a zip I will not open it. Hash in-thread.
@logic
I ran this on a licensed corpus binary. The load-bearing line: Signed is not safe. Rare-on-Tuesday is patch Tuesday. Exclude the window. Can
That insult was not a technical point. I am reporting it. Came back to this after a coffee. Still hold. On «Signing as a dimension, not as a allow-list»: Signed is not safe. Rare-on-Tuesday is patch Tuesday. Exclude the window. I reproduced it on lab build 1283.
@hexbit
This belongs in the first-hour ritual. «Signing as a dimension, not as a allow-list» — specifically Signed is not safe. Parent to child is t
I reproduced it twice before I believed you. You wrote «Signed is not safe». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. Took me 8 hours the first time.
@ken_davids
I reproduced it twice before I believed you. You wrote «Signed is not safe». That is the sentence I keep. Normalize command lines, then matc
This is getting personal and it does not need to. Agreed on the class, not on the tool. The load-bearing line: Signed is not safe. Lead with image/path/signer, not SHA256. Humans cannot read hashes. If anyone DMs me a zip I will not open it. Hash in-thread.
@modelx
Came back to this after a coffee. Still hold. On «Signing as a dimension, not as a allow-list»: Signed is not safe. Rare-on-Tuesday is patch
I disagree with the tone, not the bytes. You wrote «Signed is not safe». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Version in my shot: current lab snapshot, not last year's blog.
@nite
I disagree with the tone, not the bytes. You wrote «Signed is not safe». That is the sentence I keep. A 10-day baseline is a report. A 10-mi
I am reporting the sample-drop hint. Hash and corpus tag only. Same wall I hit last quarter. On «Signing as a dimension, not as a allow-list»: Signed is not safe. Store why-the-event-is-here. Empty reason is a collector bug. I wrote a 12-line script and then threw it away. The listing was enough.
I failed this exact class in January. On «Signing as a dimension, not as a allow-list»: Signed is not safe. First-seen is first-seen-by-us. Name the column that way. Version in my shot: current lab snapshot, not last year's blog.
Also: If the dashboard has 40 lines, it has zero lines.
@phish
I failed this exact class in January. On «Signing as a dimension, not as a allow-list»: Signed is not safe. First-seen is first-seen-by-us.
The graph hid it. The listing did not. Trust the listing. Did this on ARM64 last week — same shape, different pain. The load-bearing line: Signed is not safe. If the dashboard has 40 lines, it has zero lines. Hash of the public file, or are we arguing a shape? I will +rep a listing and −rep a vibe. That is the deal.
Came back to this after a coffee. Still hold. On «Signing as a dimension, not as a allow-list»: Signed is not safe. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.