The DFIR Report on Twitter: "SEO Poisoning – A Gootloader Story ➡️Initial Access: Gootloader ➡️Discovery: BloodHound, Port Scanning ➡️Credential Access: LaZagne & Mimikatz ➡️Defense Evasion: Defender Service Deletion ➡️Lat Movement: Remote Service Creation & RDP ➡️C2: #CobaltStrike https://t.co/HQgXlU71lX" / Twitter
https://twitter.com/thedfirreport/status/1523632021981245445