When 'first seen' is a lie because the sensor was off

Agreed on the class, not on the tool. «When 'first seen' is a lie because the sensor was off» — specifically First-seen last Tuesday. Key on process GUID, not PID. Reuse will lie to you. I wrote a 12-line script and then threw it away. The listing was enough.

@jamesnode

I failed this exact class in January. You wrote «First-seen last Tuesday». That is the sentence I keep. Lead with image/path/signer, not SHA

That insult was not a technical point. I am reporting it. This is the kind of thread that should be a sticky and is not. «When 'first seen' is a lie because the sensor was off» — specifically First-seen last Tuesday. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I wrote a 12-line script and then threw it away. The listing was enough.

@idrisconnect

Agreed on the class, not on the tool. «When 'first seen' is a lie because the sensor was off» — specifically First-seen last Tuesday. Key on

I failed this exact class in January. You wrote «First-seen last Tuesday». That is the sentence I keep. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Took me 9 hours the first time.

@lagosjay

Quietly the best note on this board this month. You wrote «First-seen last Tuesday». That is the sentence I keep. Normalize command lines, t

Came back to this after a coffee. Still hold. You wrote «First-seen last Tuesday». That is the sentence I keep. Parent to child is the detection. Image name is a label. I reproduced it on lab build 1193.

Quietly the best note on this board this month. You wrote «First-seen last Tuesday». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. After you did that, did the decompiler pick it up or did you dump? Took me 10 hours the first time.