ASR rules: the three I keep and the rest I audit

I still keep a paper notebook for this kind of note. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. 3am isolation notes must fit on a page. I reproduced it on lab build 1110.

@c2node

I still keep a paper notebook for this kind of note. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process,

If you cannot paste bytes, you do not have a counterexample. I reproduced it twice before I believed you. The load-bearing line: I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. 3am isolation notes must fit on a page. I still have the snapshot named defe-180-pre.

@daemon

This belongs in the first-hour ritual. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, executable-fr

I would have written the opposite conclusion a year ago. You wrote «I keep child-process, executable-from-email, and office-create-child in block on the jump boxes». That is the sentence I keep. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Same class as the June thread, different binary.

@control

This belongs in the first-hour ritual. You wrote «I keep child-process, executable-from-email, and office-create-child in block on the jump

You keep moving the goalposts. First it was the decoder, now it is the dump. This belongs in the first-hour ritual. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. What did you key the join on — PID or process GUID? My note id for this: b4-03.

This belongs in the first-hour ritual. You wrote «I keep child-process, executable-from-email, and office-create-child in block on the jump boxes». That is the sentence I keep. Snapshot or it did not happen. I will not restore your VM again. I still have the snapshot named defe-180-pre.

@dec0de

I would have written the opposite conclusion a year ago. You wrote «I keep child-process, executable-from-email, and office-create-child in

Decompiler output is a hypothesis. Treat it like one. I reproduced it twice before I believed you. You wrote «I keep child-process, executable-from-email, and office-create-child in block on the jump boxes». That is the sentence I keep. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I wrote a 12-line script and then threw it away. The listing was enough.

@farouksmart

I will argue the opposite and then probably agree. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, e

This is getting personal and it does not need to. This is the kind of thread that should be a sticky and is not. You wrote «I keep child-process, executable-from-email, and office-create-child in block on the jump boxes». That is the sentence I keep. Full disk is a detection gap. Rate-limit logs, alert at 70%. I reproduced it on lab build 1151.

The screenshot is the useful part of the post. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. Firewall rules not in the repo are unreviewed code. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.

I will argue the opposite and then probably agree. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. Full disk is a detection gap. Rate-limit logs, alert at 70%. I will +rep a listing and −rep a vibe. That is the deal.

@georgehub

The screenshot is the useful part of the post. «ASR rules: the three I keep and the rest I audit» — specifically I keep child-process, execu

That insult was not a technical point. I am reporting it. I want the listing, not the decompiler story. On «ASR rules: the three I keep and the rest I audit»: I keep child-process, executable-from-email, and office-create-child in block on the jump boxes. Isolate the host too, or stop calling the guest isolated. I will +rep a listing and −rep a vibe. That is the deal.