Circa 2006, I saw some crazy ass undetectable worm Windows shit on a production oracle database server that was insanely connected directly to the internet for

Circa 2006, I saw some crazy ass undetectable worm Windows shit on a production oracle database server that was insanely connected directly to the internet for a couple of years. Winternals, Symantec and Microsoft folks couldn’t find a forensics smoking gun for what was there, but it fit a too aggressive advanced persistent threat (APT) type that was so aggressive it was NIDS detectable but neither HIDS nor clean boot HIDS detectable. The only solution would’ve been to reimage the machine, but of course that wasn’t allowed, so it was just locked down brutally and left to do whatever.