Richard BejtlichSome people wonder why I’m not that interested in the technical details behind most intrusions these days. The recent excellent reporting by @TheDFIRReport shows why. The intruders used scheduled tasks as the persistence mechanism. SCHEDULED TASKS, like what we Foundstone consultants taught students to look for in 2002. Sure, occasionally an intruder does something interesting, but almost universally, from tools, to tactics, to operations/campaigns, to strategy, to policy, it’s been SSDD *for decades.* And orgs still get owned, and govs say do better, and vendors do or don’t invest in “secure” products, and consultants and defenders scramble, and others undermine their work. Le sigh.
| Twitter Profile | https://twitter.com/MrBenChung |
b_fung
raptor 
0xor0ne
ComfyConAU
Swissky 
