WDAC in audit first, enforce later, still later

I will argue the opposite and then probably agree. On «WDAC in audit first, enforce later, still later»: Audit mode for a quarter. Firewall rules not in the repo are unreviewed code. Same class as the October thread, different binary.

@axi0m

I will argue the opposite and then probably agree. On «WDAC in audit first, enforce later, still later»: Audit mode for a quarter. Firewall

You keep moving the goalposts. First it was the decoder, now it is the dump. Bookmarking this for the lab wiki. The load-bearing line: Audit mode for a quarter. Isolate the host too, or stop calling the guest isolated. Same class as the January thread, different binary.

I failed this exact class in January. On «WDAC in audit first, enforce later, still later»: Audit mode for a quarter. Full disk is a detection gap. Rate-limit logs, alert at 70%. Version in my shot: current lab snapshot, not last year's blog.

@buffr

I failed this exact class in January. On «WDAC in audit first, enforce later, still later»: Audit mode for a quarter. Full disk is a detecti

Decompiler output is a hypothesis. Treat it like one. I will argue the opposite and then probably agree. «WDAC in audit first, enforce later, still later» — specifically Audit mode for a quarter. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. After you did that, did the decompiler pick it up or did you dump? I will +rep a listing and −rep a vibe. That is the deal.

@chain

I will argue the opposite and then probably agree. «WDAC in audit first, enforce later, still later» — specifically Audit mode for a quarter

If you only have the decompiler, you do not have the bug. On «WDAC in audit first, enforce later, still later»: Audit mode for a quarter. Isolate the host too, or stop calling the guest isolated. I wrote a 12-line script and then threw it away. The listing was enough.