Offensive perspective

As the attacker, if we land on a well-instrumented host, we can take several advanced steps to reduce the data the defender may collect. As we saw in the previous chapters, the defender will heavily rely on host-based technologies to generate the necessary security telemetry. The attacker, who may have similar privileges on this host, should naturally reduce these defensive capabilities before they result in the attacker being detected. By removing the defender's logs and tampering with their tools, we can severely hamper the defender's ability to detect and then respond to the event. In their most pure form, these deceptive techniques, which wrestle the basic perspective operations away from the defenders, are known as rootkits. While traditional rootkits often require kernel-level permissions, we can understand them as any attacker technique that actively changes defensive perceptions about a host to hide attacker tools. In practice, this means many...