🎲 Role player, Game master.

  • 5 Posts
  • 4 Comments
Joined 6 days ago
cake
Cake day: March 4th, 2025

help-circle



  • Dude gave anyone looking for forensic clues a layup

    would lock every employee out of their accounts if his credentials were ever revoked, and named the code IsDLEnabledinAD, as in “Is Davis Lu enabled in Active Directory.”

    That’s kind of an easy figure out: look for all the D.L.s in the company and work from there. But then

    investigators subsequently found the source code for this program on an internal development server in Kentucky, and that Lu’s user account had been used to execute the malware on the production box. Lu was also the only member of his team who had access privileges for that dev machine.

    This guy left an easy forensic trail.