Posts on cross-platform kernel-level diagnostics, behavioral security monitoring, AI-powered analysis, and operator-driven privilege elevation
ET Ducky agent 2.8.1.0 adds install paths, apps installed for one Windows user, and Microsoft Store packages to the installed-application inventory, with a refresh on demand.
Bind the VoiceStudio desktop app backend to your LAN with OMNIVOICE_BACKEND_CMD, a settings file, and a firewall rule so other devices can generate speech from the voices you designed.
How a Surface Pro X running Windows 11 on ARM64 is enrolled in ET Ducky, scripted from GitHub, updated from the dashboard, and kept in a kiosk profile, with lessons from running scripts.
Published pricing and features for ET Ducky and Atera in one table, from each vendor's pricing page and documentation, with billing model, endpoints, patching, and dated sources.
When Windows servers block all traffic until the firewall is turned off, find the deleted rules with firewall events 2033 and 2059, the active policy store, gpresult, and the audit log.
Tell a crash from a stop request when a service is inactive after an Ubuntu or Debian update, using systemctl status, apt history, the unattended-upgrades logs, needrestart, and journalctl.
Copy on select, text size, and full screen in the web shells and the serial console, shell sessions that fit a phone screen, a dark Fleet Tools terminal, and two documentation fixes.
Network Discovery keeps hosts the scan could not fingerprint in the agent-compatible Devices filter and out of Non-computers, and the Live Session run-as user label fits its toolbar.
Name the process behind a short CPU spike on a Linux server after the alert clears, using sar, atop history at a 60 second interval, systemd timers, the journal, and execsnoop.
Remote control permissions granted under Systems > Security, keyboard shortcut capture in remote desktop, Run as logged in user in Fleet Tools, and documentation search that keeps your query.
Published pricing and features for ET Ducky and Syncro in one table, from each vendor's pricing page and documentation, with billing model, endpoints, patching, and dated sources.
Find why a Windows 11 secure channel keeps failing after KB5124008 by checking Machine Identity Isolation, testing each domain controller, and reading Netlogon events and logs.
Per-agent settings for Windows sign-in screens and UAC prompts in remote desktop, an agent buffer limit, agent relinking after a restore, and a Recovery and Repair docs page.
Mobile remote desktop gets quick keys for common shortcuts, a Type button for the on-screen keyboard, and trackpad tap fixes. The agents table and top bar now render correctly on phones.
How an RMM agent gets data from a Linux host by polling /proc, the audit subsystem, or eBPF, what each can answer about something that already happened, and a ten-minute test on one host.
Checks that can report success without the thing they check being true, why review does not catch them, and the rule for adding verification that cannot pass vacuously.
A strategy for the unused members an AI-assisted codebase accumulates, covering which analyzer rules carry real signal, why the escalation order matters, and where static analysis stops helping.
A nightly load spike on a managed Postgres was the data-retention service itself. Why chunk drops replace per-org row DELETEs on a hypertable, and how ctid can delete rows in the wrong chunk.
The ET Ducky dashboard installs as a Progressive Web App on Android and iOS, delivers alerts through web push with on-call routing, and runs remote desktop sessions with touch controls.
Two ways to install the ET Ducky agent on an unmanaged host found by network discovery. A one-time enrollment link the host runs itself, and a gateway push over WinRM or SSH with a credential relay.
How the ET Ducky Linux agent captures the screen on Wayland using the xdg-desktop-portal ScreenCast and RemoteDesktop interfaces, a PipeWire to GStreamer pipeline, and an x11vnc fallback.
The Linux capture helper encodes H.264, the agent relays Annex-B NALUs over a WebSocket, and the dashboard decodes them with the WebCodecs VideoDecoder. Covers the wire format and keyframe recovery.
Eleven custom Roslyn analyzers built from production incidents and audit findings, with the conservative syntax rules, the greppable justification markers, and the runtime verification check.
Which Windows memory signals come from kernel keywords, which keywords only work on the NT Kernel Logger session, and the keyword set the ET Ducky memory-growth profile uses.
The winget package index is a downloadable msix holding a SQLite database. This post covers where the artifact lives, the packages table columns, name folding for matching, and the weekly refresh.
ET Ducky's Local-First tier runs the full stack on your own infrastructure as Docker images with unlimited agents at $650 per month. Covers licensing, identity, updates, and network egress.
NinjaOne is quote-only. Community reporting puts core RMM at $2.50 to $4.50 per endpoint per month, near $5 to $6 under 50 endpoints and below $2 at 1,000 or more endpoints.
Atera publishes per-technician pricing with unlimited endpoints. IT department plans run $149 to $219 per tech per month billed annually and MSP plans about $129 to $209, plus paid add-ons.
Syncro publishes per-user pricing with unlimited endpoints. Core is $129 per user per month billed annually ($159 monthly) and Team is $179 ($209 monthly), with RMM and PSA included.
RMMs reach a machine's hardware controller either through a separate Intel EMA server or from the RMM's own agent and gateway. Compares what each requires, where provisioning runs, and control mode.
How the ET Ducky agent relays out-of-band commands and configures dormant Intel AMT from the host, covering the MEI transport, AMTHI, the LME port-forwarding tunnel, and the WS-Man setup call.
ET Ducky manages business-class hardware below the operating system over Intel AMT, DASH, and IPMI. Covers the WS-Man discovery probe, device eligibility, power and console, and gateway hosting.
The out-of-band gateway inventories the hosts on its local network and marks which are not running the ET Ducky agent. Covers the admin-triggered sweep, MAC and hostname correlation, and the views.
How the Software Catalog resolves a third-party application by name, searching winget and the Linux fleet inventory first, falling back to an AI web search, and verifying installers before install.
How the ET Ducky agent hashes approved application binaries, how the cloud elects a per-organization trusted reference, and how on-disk tampering is detected and reported.
Two ways to detect malicious behavior in kernel telemetry. Signature and threshold rules match known-bad shapes, and a per-application fleet baseline learns normal and flags deviation from it.
When an application works on one Windows machine and fails on another, the cause is usually environmental. Record what the app touches with ETW and diff it against the broken machine.
How eBPF syscall tracepoints on Linux and ETW providers on Windows attribute a network connection to a process, why one is direct and the other requires correlation, and what each approach misses.
A reference for the ETW providers that see network activity on Windows, covering what Kernel-Network, TCPIP, and NDIS-PacketCapture emit and how to correlate a packet back to a process.
A maintained reference of RMM pricing with per-device and per-technician rates for NinjaOne, ConnectWise, Datto, Kaseya, Atera, Syncro, Barracuda, and ET Ducky, plus sources and methodology.
Kaseya VSA is quote-only. Community-reported rates run roughly $3 to $6 per device per month plus $1,000 to $10,000+ implementation. Kaseya 365 Endpoint is priced per endpoint by quote.
Datto RMM is quote-only, with no published per-endpoint rate. Covers the December 2025 move off high-watermark billing to committed minimum quantity billing and what RMM does not include.
ConnectWise RMM is quote-only across the Essentials, Pro, and Premium tiers. Community estimates put it at $1.50 to $3.50 per agent per month, with ScreenConnect Remote Access in every tier.
A walkthrough of an ET Ducky multi-agent session that diagnosed a host to VM ping failure across four machines, with the commands it ran, the settings it changed, and the verification step.
How ET Ducky's dynamic ETW agent picks providers for each investigation round, enforces capture caps inside the engine, and keeps raw events on the host while uploading counts only.
How the ET Ducky Windows helper meets the four uiAccess preconditions, captures the Winlogon secure desktop with GDI BitBlt, and injects input while a UAC prompt is on screen.
Four cross-platform behavioral rules cover shadow copy deletion, mass file rename to ransomware extensions, ransom note creation, and cryptominer execution, plus a kill-chain meta-rule.
The ET Ducky agent collects seven inventory domains on Linux and Windows at boot, every 24 hours, and on demand, storing each domain in its own JSONB column for Smart Reports queries.
ET Ducky's Linux agent attaches eBPF programs to scheduler and syscall tracepoints for kernel event capture, uses CO-RE and BTFHub for portability, and shares the Windows agent's pipeline.
A walkthrough of the thirteen cross-platform detection rules the ET Ducky agent ships with, covering exec chains, mass file access, ransom notes, shadow-copy deletion, backup sabotage, encryption sweeps, process ancestry, and crypto-miner command lines.
The ET Ducky agent captures the desktop with DXGI on Windows and the Wayland portal or x11vnc on Linux, encodes H.264 where hardware allows, and streams frames to a browser viewer.
ET Ducky's Linux agent runs as an unprivileged user. Privileged commands require an operator to authorize each action from the dashboard, and every request is recorded in an immutable audit row.
Pricing models and feature coverage for seven RMM platforms in 2026, with a cost calculator. Covers ET Ducky, NinjaOne, ConnectWise RMM, Datto RMM, Atera, Kaseya VSA, and Syncro.
Reference for the Microsoft-Windows-Kernel-Memory ETW provider covering GUID D1D93EF7-E1F2-4F45-9943-03D245FE6C00, keyword masks, logman and C# TraceEvent examples, and the capture workflow.
Comparison of WMI polling, the Windows Event Log, and Event Tracing for Windows (ETW) as RMM data sources, covering sampling behavior, data volume, and the kernel events each one records.
How a two-stage pipeline correlates ETW events on the host and sends the reduced summary to an LLM, with an example IIS incident and the model output produced from it.