EXECUTION GUARDRAILS: NO ONE LIKES UNINTENTIONAL EXPOSURE

Summary from the TLDR InfoSec newsletter

A post from TrustedSec's Brandon McGrath which begins with a discussion of an engagement where his implant got caught by a member of the blue team. McGrath details how he uses a key ring consisting of host based checks, network checks, and external checks as an execution guardrail. In the example, the implant first checked the hostname of the system, then network shares, and finally a TXT record before downloading and launching the payload.