Posts on cross-platform kernel-level diagnostics, behavioral security monitoring, AI-powered analysis, and operator-driven privilege elevation
Checks that can report success without the thing they check being true, why review does not catch them, and the rule for adding verification that cannot pass vacuously.
A strategy for the unused members an AI-assisted codebase accumulates, covering which analyzer rules carry real signal, why the escalation order matters, and where static analysis stops helping.
A nightly load spike on a managed Postgres was the data-retention service itself. Why chunk drops replace per-org row DELETEs on a hypertable, and how ctid can delete rows in the wrong chunk.
The ET Ducky dashboard installs as a Progressive Web App on Android and iOS, delivers alerts through web push with on-call routing, and runs remote desktop sessions with touch controls.
Two ways to install the ET Ducky agent on an unmanaged host found by network discovery. A one-time enrollment link the host runs itself, and a gateway push over WinRM or SSH with a credential relay.
How the ET Ducky Linux agent captures the screen on Wayland using the xdg-desktop-portal ScreenCast and RemoteDesktop interfaces, a PipeWire to GStreamer pipeline, and an x11vnc fallback.
The Linux capture helper encodes H.264, the agent relays Annex-B NALUs over a WebSocket, and the dashboard decodes them with the WebCodecs VideoDecoder. Covers the wire format and keyframe recovery.
Eleven custom Roslyn analyzers built from production incidents and audit findings, with the conservative syntax rules, the greppable justification markers, and the runtime verification check.
Which Windows memory signals come from kernel keywords, which keywords only work on the NT Kernel Logger session, and the keyword set the ET Ducky memory-growth profile uses.
The winget package index is a downloadable msix holding a SQLite database. This post covers where the artifact lives, the packages table columns, name folding for matching, and the weekly refresh.
ET Ducky's Local-First tier runs the full stack on your own infrastructure as Docker images with unlimited agents at $650 per month. Covers licensing, identity, updates, and network egress.
NinjaOne is quote-only. Community reporting puts core RMM at $2.50 to $4.50 per endpoint per month, near $5 to $6 under 50 endpoints and below $2 at 1,000 or more endpoints.
Atera publishes per-technician pricing with unlimited endpoints. IT department plans run $149 to $219 per tech per month billed annually and MSP plans about $129 to $209, plus paid add-ons.
Syncro publishes per-user pricing with unlimited endpoints. Core is $129 per user per month ($107.50 billed annually) and Team is $179 ($149.17 annually), with RMM and PSA included.
RMMs reach a machine's hardware controller either through a separate Intel EMA server or from the RMM's own agent and gateway. Compares what each requires, where provisioning runs, and control mode.
How the ET Ducky agent relays out-of-band commands and configures dormant Intel AMT from the host, covering the MEI transport, AMTHI, the LME port-forwarding tunnel, and the WS-Man setup call.
ET Ducky manages business-class hardware below the operating system over Intel AMT, DASH, and IPMI. Covers the WS-Man discovery probe, device eligibility, power and console, and gateway hosting.
The out-of-band gateway inventories the hosts on its local network and marks which are not running the ET Ducky agent. Covers the admin-triggered sweep, MAC and hostname correlation, and the views.
How the Software Catalog resolves a third-party application by name, searching winget and the Linux fleet inventory first, falling back to an AI web search, and verifying installers before install.
How the ET Ducky agent hashes approved application binaries, how the cloud elects a per-organization trusted reference, and how on-disk tampering is detected and reported.
Two ways to detect malicious behavior in kernel telemetry. Signature and threshold rules match known-bad shapes, and a per-application fleet baseline learns normal and flags deviation from it.
When an application works on one Windows machine and fails on another, the cause is usually environmental. Record what the app touches with ETW and diff it against the broken machine.
How eBPF syscall tracepoints on Linux and ETW providers on Windows attribute a network connection to a process, why one is direct and the other requires correlation, and what each approach misses.
A reference for the ETW providers that see network activity on Windows, covering what Kernel-Network, TCPIP, and NDIS-PacketCapture emit and how to correlate a packet back to a process.
A maintained reference of RMM pricing with per-device and per-technician rates for NinjaOne, ConnectWise, Datto, Kaseya, Atera, Syncro, Barracuda, and ET Ducky, plus sources and methodology.
Kaseya VSA is quote-only. Community-reported rates run roughly $3 to $6 per device per month plus $1,000 to $10,000+ implementation, with Kaseya 365 at about $299 to $399 per technician.
Datto RMM publishes a base rate of around $2.99 per endpoint per month, billed all-inclusive. Covers the mid-2026 move off high-watermark billing and what the rate does not include.
ConnectWise RMM is quote-only across the Essential, Pro, and Premium tiers. Community estimates put it at $1.50 to $3.50 per agent per month, with ScreenConnect included and modules sold extra.
A walkthrough of an ET Ducky multi-agent session that diagnosed a host to VM ping failure across four machines, with the commands it ran, the settings it changed, and the verification step.
How ET Ducky's dynamic ETW agent picks providers for each investigation round, enforces capture caps inside the engine, and keeps raw events on the host while uploading counts only.
How the ET Ducky Windows helper meets the four uiAccess preconditions, captures the Winlogon secure desktop with GDI BitBlt, and injects input while a UAC prompt is on screen.
Four cross-platform behavioral rules cover shadow copy deletion, mass file rename to ransomware extensions, ransom note creation, and cryptominer execution, plus a kill-chain meta-rule.
The ET Ducky agent collects seven inventory domains on Linux and Windows at boot, every 24 hours, and on demand, storing each domain in its own JSONB column for Smart Reports queries.
ET Ducky's Linux agent attaches eBPF programs to scheduler and syscall tracepoints for kernel event capture, uses CO-RE and BTFHub for portability, and shares the Windows agent's pipeline.
A walkthrough of the ten cross-platform detection rules the ET Ducky agent ships with, covering exec chains, mass file access, ransom notes, shadow-copy deletion, and crypto-miner command lines.
The ET Ducky agent captures the desktop with DXGI on Windows and the Wayland portal or x11vnc on Linux, encodes H.264 where hardware allows, and streams frames to a browser viewer.
ET Ducky's Linux agent runs as an unprivileged user. Privileged commands require an operator to authorize each action from the dashboard, and every request is recorded in an immutable audit row.
Pricing models and feature coverage for seven RMM platforms in 2026, with a cost calculator. Covers ET Ducky, NinjaOne, ConnectWise RMM, Datto RMM, Atera, Kaseya VSA, and Syncro.
Reference for the Microsoft-Windows-Kernel-Memory ETW provider covering GUID D1D93EF7-E1F2-4F45-9943-03D245FE6C00, keyword masks, logman and C# TraceEvent examples, and the capture workflow.
Comparison of WMI polling, the Windows Event Log, and Event Tracing for Windows (ETW) as RMM data sources, covering sampling behavior, data volume, and the kernel events each one records.
How a two-stage pipeline correlates ETW events on the host and sends the reduced summary to an LLM, with an example IIS incident and the model output produced from it.