As a threat hunter/IR practitioner, what is your primary means of determining if a system file is actually a system file and not backdoored?
-
-
Replying to @mattifestation
I'd say there is no primary means if you want to be 100% sure; rather a combination of these is a good start.
1 reply 0 retweets 4 likes -
Replying to @bartblaze
Agreed but Twitter polls don't allow multiple selections.
1 reply 0 retweets 0 likes
Replying to @mattifestation
Ha, true enough :) A surprising amount of people seem to (only?) rely on sig validation.
8:32 AM - 17 Aug 2017
0 replies
0 retweets
1 like
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.