So in my last post, I described a method for homing in on who is doing what on the network whilst a machine is shutting down. I expect some, a few, random noise data points represented by PID 0 due to requests being made and then the process being killed before the network activity happens. Or perhaps some last throes of a zombied process finally being cleaned up, 

In the event you have something that only impacts an endpoint when it is being logged off/shutdown, you can do the following to collect declarative data. mkdir C:\temp cd C:\temp netsh trace start capture=yes correlation=yes l report=no tracefile=C:\temp\netshtrace.etl then follow it up with the instructions in this post: This will shutdown the machine. Power it back up, your WPR recording is in Documents\WPR files\

The Key to Scraping YouTube: Planning an Efficient Route In our last run, our scraper successfully raided the WoW-only channels, defeating bosses and amassing a wealth of comments. But no…

This is an odd fellow here. As you can see in the image below, AUEPMaster has 157k handles. Yesterday it had over 1 million but I failed to capture a screenshot before reboot. This hasn't impacted game performance as far as I can tell, just an annoyance. Wondering if it's actually working as intended, does it have a security hole, etc...

DPM causes zombie processes, software version 2.0.0.72

Summary

This is the biggest investigation we’ve ever published.

Large language models (LLMs) are potent tools, however, their default configurations often fall short in providing the accuracy and consistency required for reliable, critical analysis. In this post, ...

Three weeks ago, Gootloader samples suddenly dried up. This has happened before, so I switched VPNs and tried new locations—coffee shops, friends’, and family’s Wi-Fi networks—but still couldn’t re…

Welcome to The Debrief with Mat Honan, your weekly take on the tech news that really matters, links to stories we love, and the occasional recommendation.

First true sign of AGI – blowing a fuse with a frustrating user?

Jeff Stokes's answer: I had a blind request on LinkedIn a few years ago. A police officer in a small-ish college town asking if I could help mentor him in the IT field. I agreed because he seemed pass...