The DFIR Report on Twitter: "Dead or Alive? An Emotet Story ➡️Initial Access: Emotet XLS ➡️Persistence: RegRunKeys, Atera ➡️Discovery: LOLbins, AdFind, ShareFinder ➡️Credentials: LSASS access, Kerberoast ➡️Lateral: SMB, Remote Services ➡️C2: Emotet, CobaltStrike ➡️Exfil: Rclone/Mega https://t.co/6aeqp36LaL" / Twitter

https://twitter.com/thedfirreport/status/1569288947120984064

https://x.com/home/status/1569327638182825984

https://x.com/home/status/1569327682000756738

https://x.com/home/status/1569331053990449153

https://x.com/home/status/1569333625971437571

https://x.com/home/status/1569338505586671617

https://x.com/home/status/1569339071545200640

https://x.com/home/status/1569339239145381896

https://x.com/home/status/1569354345732538369

https://x.com/home/status/1569354960403300357

https://x.com/home/status/1569359778199240704

https://x.com/home/status/1569389587998412801