I want ETW on the analysis VM, and I want it off the sample's network

I still keep a paper notebook for this kind of note. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Firewall rules not in the repo are unreviewed code. If anyone DMs me a zip I will not open it. Hash in-thread.

@danielrocks

I tried the naive path first and wasted a morning. You wrote «Telemetry out of band». That is the sentence I keep. Jump box is not a desktop

Decompiler output is a hypothesis. Treat it like one. I disagree with the tone, not the bytes. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Firewall rules not in the repo are unreviewed code. My note id for this: cf-02.

I still keep a paper notebook for this kind of note. On «I want ETW on the analysis VM, and I want it off the sample's network»: Telemetry out of band. Firewall rules not in the repo are unreviewed code. I reproduced it on lab build 1235.

@crypt

I still keep a paper notebook for this kind of note. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically

I tried the naive path first and wasted a morning. You wrote «Telemetry out of band». That is the sentence I keep. Jump box is not a desktop. No browser, no mail, no Slack. If anyone DMs me a zip I will not open it. Hash in-thread.

@grayx

This belongs in the first-hour ritual. You wrote «Telemetry out of band». That is the sentence I keep. Allow-list entries expire. 90 days or

I want the listing, not the decompiler story. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Full disk is a detection gap. Rate-limit logs, alert at 70%. If anyone DMs me a zip I will not open it. Hash in-thread.

@eliashub

I tried the naive path first and wasted a morning. The load-bearing line: Telemetry out of band. If debug requires turning the control off,

I failed this exact class in January. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Allow-list entries expire. 90 days or they are a vulnerability. If anyone DMs me a zip I will not open it. Hash in-thread.

Good. Dated shot, version in the post. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Did you force-create the function or did auto-analysis luck into it? I still have the snapshot named defe-207-pre.

I tried the naive path first and wasted a morning. The load-bearing line: Telemetry out of band. If debug requires turning the control off, the debug story is wrong. Did you snapshot before, or is this a restore-from-memory story? Took me 3 hours the first time.

I dumped after OEP and then did this. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Firewall rules not in the repo are unreviewed code. If anyone DMs me a zip I will not open it. Hash in-thread.

@intelx

I failed this exact class in January. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out o

The graph hid it. The listing did not. Trust the listing. Did this on ARM64 last week — same shape, different pain. On «I want ETW on the analysis VM, and I want it off the sample's network»: Telemetry out of band. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

@freq

I still keep a paper notebook for this kind of note. On «I want ETW on the analysis VM, and I want it off the sample's network»: Telemetry o

That insult was not a technical point. I am reporting it. This belongs in the first-hour ritual. You wrote «Telemetry out of band». That is the sentence I keep. Allow-list entries expire. 90 days or they are a vulnerability. I reproduced it on lab build 1183.

I failed this exact class in January. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. If anyone DMs me a zip I will not open it. Hash in-thread.

Good. Dated shot, version in the post. You wrote «Telemetry out of band». That is the sentence I keep. Firewall rules not in the repo are unreviewed code. Version in my shot: current lab snapshot, not last year's blog.

Also: Except the instance, keep the class. Publisher plus path, not 'allow RWX'.

@liveconnect

Good. Dated shot, version in the post. You wrote «Telemetry out of band». That is the sentence I keep. Firewall rules not in the repo are un

Came back to this after a coffee. Still hold. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Full disk is a detection gap. Rate-limit logs, alert at 70%. Can you quote the offset instead of the graph screenshot? Took me 3 hours the first time.

@matrx

Came back to this after a coffee. Still hold. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemet

Calling the sticky 'priest talk' is how you earn a ban note. Agreed on the class, not on the tool. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Isolate the host too, or stop calling the guest isolated. I wrote a 12-line script and then threw it away. The listing was enough.

I still keep a paper notebook for this kind of note. The load-bearing line: Telemetry out of band. Jump box is not a desktop. No browser, no mail, no Slack. Took me 8 hours the first time.

@oladipupo

I still keep a paper notebook for this kind of note. The load-bearing line: Telemetry out of band. Jump box is not a desktop. No browser, no

Did this on ARM64 last week — same shape, different pain. On «I want ETW on the analysis VM, and I want it off the sample's network»: Telemetry out of band. 3am isolation notes must fit on a page. Pinned a comment at 0x14000648e in the listing.

I will argue the opposite and then probably agree. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Full disk is a detection gap. Rate-limit logs, alert at 70%. My note id for this: cf-17.

@prosmart

I will argue the opposite and then probably agree. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Te

If you cannot paste bytes, you do not have a counterexample. Quietly the best note on this board this month. The load-bearing line: Telemetry out of band. Allow-list entries expire. 90 days or they are a vulnerability. Can you quote the offset instead of the graph screenshot? I will +rep a listing and −rep a vibe. That is the deal.

@richkiddo

Quietly the best note on this board this month. The load-bearing line: Telemetry out of band. Allow-list entries expire. 90 days or they are

Not fully convinced yet. You wrote «Telemetry out of band». That is the sentence I keep. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I wrote a 12-line script and then threw it away. The listing was enough.

I dumped after OEP and then did this. The load-bearing line: Telemetry out of band. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

Also: Full disk is a detection gap. Rate-limit logs, alert at 70%.

Not fully convinced yet. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. I still have the snapshot named defe-207-pre.

@stackx

Not fully convinced yet. «I want ETW on the analysis VM, and I want it off the sample's network» — specifically Telemetry out of band. Host-

Decompiler output is a hypothesis. Treat it like one. If you only have the decompiler, you do not have the bug. The load-bearing line: Telemetry out of band. Firewall rules not in the repo are unreviewed code. If anyone DMs me a zip I will not open it. Hash in-thread.