> We detected the attacker at this stage, based on a number of behaviors (e.g. Firefox shouldn’t spawn a shell). They explicitly state it was one of the behavi

> We detected the attacker at this stage, based on a number of behaviors (e.g. Firefox shouldn’t spawn a shell). They explicitly state it was one of the behaviors they detected as suspicious.