Lab detonations in the prod store made a hunt that was 90% our own samples. Separate DBs. Separate dashboards. Same schema.
If you detonate in prod telemetry, you deserve the hairball.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I dumped after OEP and then did this. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hunt that was 90% our own samples. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Version in my shot: current lab snapshot, not last year's blog.
Did this on ARM64 last week — same shape, different pain. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hunt that was 90% our own samples. Parent to child is the detection. Image name is a label. Did you force-create the function or did auto-analysis luck into it? Same class as the January thread, different binary.
@gh0st
I dumped after OEP and then did this. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hu
Same wall I hit last quarter. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hunt that was 90% our own samples. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.
@hasher
Same wall I hit last quarter. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hunt that
I am reporting the sample-drop hint. Hash and corpus tag only. If you only have the decompiler, you do not have the bug. The load-bearing line: Lab detonations in the prod store made a hunt that was 90% our own samples. Rare-on-Tuesday is patch Tuesday. Exclude the window. I will +rep a listing and −rep a vibe. That is the deal.
I would have written the opposite conclusion a year ago. The load-bearing line: Lab detonations in the prod store made a hunt that was 90% our own samples. Rare-on-Tuesday is patch Tuesday. Exclude the window. If anyone DMs me a zip I will not open it. Hash in-thread.
@lawrencex
Same wall I hit last quarter. «Lab vs prod telemetry — I keep them in different DBs» — specifically Lab detonations in the prod store made a
This is the kind of thread that should be a sticky and is not. You wrote «Lab detonations in the prod store made a hunt that was 90% our own samples». That is the sentence I keep. If the dashboard has 40 lines, it has zero lines. I still have the snapshot named anal-161-pre.
@inject
Did this on ARM64 last week — same shape, different pain. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the
I dumped after OEP and then did this. You wrote «Lab detonations in the prod store made a hunt that was 90% our own samples». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. Took me 4 hours the first time.
@keyx
I would have written the opposite conclusion a year ago. The load-bearing line: Lab detonations in the prod store made a hunt that was 90% o
Stop flexing an IDA license. The question was the unwind info. Same wall I hit last quarter. «Lab vs prod telemetry — I keep them in different DBs» — specifically Lab detonations in the prod store made a hunt that was 90% our own samples. Normalize command lines, then match. Raw matching is a bypass factory. My note id for this: a1-06.
I will argue the opposite and then probably agree. You wrote «Lab detonations in the prod store made a hunt that was 90% our own samples». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. Can you quote the offset instead of the graph screenshot? Took me 10 hours the first time.
I reproduced it twice before I believed you. You wrote «Lab detonations in the prod store made a hunt that was 90% our own samples». That is the sentence I keep. Key on process GUID, not PID. Reuse will lie to you. Same class as the January thread, different binary.
@nova
I reproduced it twice before I believed you. You wrote «Lab detonations in the prod store made a hunt that was 90% our own samples». That is
That is a vibe. I asked for a listing offset. I tried the naive path first and wasted a morning. On «Lab vs prod telemetry — I keep them in different DBs»: Lab detonations in the prod store made a hunt that was 90% our own samples. Normalize command lines, then match. Raw matching is a bypass factory. I reproduced it on lab build 1135.