Conversation

examples:

• why does clickfix still work? Because all of your users have access to powershell and none of them need it. Also, all of your users have access to the run prompt, and in this case they have absolutely no need for it (the vast majority not even knowing it existed before that totally legit cloudflare notification popped up, asking them to open it)

• Why do reverse shells and other random bullshit traffic on seemingly random ports, including SMB traffic still work for payload delivery? because egress filtering was never, and will never be implemented because it gives the executives bad vibes.

and no, I'm not placing the blame at the users' feet. These avenues should have NEVER been available in the first place. Its not their job to know that its an avenue of attack. It was the company's job to know that, and have a plan to unmake that avenue of attack at a fucking cellular level.