3 ms·
Yep, this kind of thing is typically used as an EDR-killer when you want to touch protected processes and perform lateral movement. It’s interesting to see it u
by rtev 4y ago
Yep, this kind of thing is typically used as an EDR-killer when you want to touch protected processes and perform lateral movement. It’s interesting to see it used here as part of initial access tooling.
- dobin 4y agoI also mostly seen it as EDR/AV killer. A bit overkill as initial access, but thats part of the joke of the article