ASCII trees paste into tickets. GUI screenshots do not grep. I generate ASCII from the same sqlite.
If your IR ticket cannot be quoted in a forum, it is not a ticket. It is a mood board.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
Did this on ARM64 last week ā same shape, different pain. Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ» ā specifically ASCII trees paste into tickets. If the dashboard has 40 lines, it has zero lines. I wrote a 12-line script and then threw it away. The listing was enough.
@hassanwise
Did this on ARM64 last week ā same shape, different pain. Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ» ā specifically A
That is a vibe. I asked for a listing offset. I reproduced it twice before I believed you. Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ» ā specifically ASCII trees paste into tickets. Store why-the-event-is-here. Empty reason is a collector bug. I reproduced it on lab build 1128.
I ran this on a licensed corpus binary. On Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ»: ASCII trees paste into tickets. First-seen is first-seen-by-us. Name the column that way. Version in my shot: current lab snapshot, not last year's blog.
@kabirjay
Quietly the best note on this board this month. You wrote Ā«ASCII trees paste into ticketsĀ». That is the sentence I keep. Normalize command l
This matches a public n-day class from last patch Tuesday. Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ» ā specifically ASCII trees paste into tickets. Parent to child is the detection. Image name is a label. I still have the snapshot named anal-162-pre.
@l0gic
This matches a public n-day class from last patch Tuesday. Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ» ā specifically
You keep moving the goalposts. First it was the decoder, now it is the dump. Agreed on the class, not on the tool. The load-bearing line: ASCII trees paste into tickets. Parent to child is the detection. Image name is a label. If anyone DMs me a zip I will not open it. Hash in-thread.
I want the listing, not the decompiler story. On Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ»: ASCII trees paste into tickets. First-seen is first-seen-by-us. Name the column that way. Pinned a comment at 0x140000483 in the listing.
@intelx
I ran this on a licensed corpus binary. On Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ»: ASCII trees paste into tickets
If you cannot paste bytes, you do not have a counterexample. Quietly the best note on this board this month. You wrote Ā«ASCII trees paste into ticketsĀ». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. Can you quote the offset instead of the graph screenshot? I wrote a 12-line script and then threw it away. The listing was enough.
@matrx
I want the listing, not the decompiler story. On Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ»: ASCII trees paste into t
Decompiler output is a hypothesis. Treat it like one. I dumped after OEP and then did this. On Ā«Process trees as ASCII in the ticket, not a screenshot of a GUIĀ»: ASCII trees paste into tickets. Key on process GUID, not PID. Reuse will lie to you. Same class as the January thread, different binary.