my tweets are severely limited by my lack of understanding of what I am doing.
#EternalPot another Coin miner just dropped, uses scheduled task to deploy later.pic.twitter.com/7cffniJkoC
-
Because AV and next gen tools widely don't stop the exploit, attackers are starting to schedule tasks, WMI filters etc to stop sec products.
The idea is if you can stop the products before aiming for payload, you can stop detection. They're almost all really badly done attempts.
