Agree, if we look at e.g. the leaked Conti manuals the TTPs there ...

2026-10-13T18:34:49Z

In reply to nevent1q…l8ey
_________________________

Agree, if we look at e.g. the leaked Conti manuals the TTPs there are optimized to find a solution with the least friction in most AD environments. Here, I've seen baffling decisions like winrm is not working for lateral movement? Let's configure it through a remote scheduled task!

First time I'm dealing with an incident where, at least in my ...

2026-10-13T17:32:09Z

First time I'm dealing with an incident where, at least in my opinion, the operator decided "AI take the wheel" and hand over post-exploitation to LLM. It would be funny, if there wasn't a real damage done. Nevertheless, few observations:<li>LLM clearly has problem distinguishing operator's machine and the beachhead host. So, it leaked his working directory, with username and language when generating a script to copy files between hosts...</li><li>Operator is pretending it is a pentest. So LLM documents everything. There are a lot of debug messages in logs. It checks <code>whoami</code> and <code>hostname</code> way too often.</li><li>Post-exploitations scripts are very helpfully prefixed with a sequential number showing order of execution, making establishing timeline much easier.</li><li>Everything is PowerShell except that one time, when it decided to rewrite <code>tasklist</code> in C#... PowerShell constrained mode would have greatly helped, at least forcing it to be even more noisy.</li><li>It's not fast. I mean the execution is fast, but while the operator reviews output and writes new prompt it takes time, the whole intrusion still spans days and is super noisy.</li><li>Everything is living-off-the-land and generic scripting. No malware.</li><li>It has very uncanny feeling, just like everything AI. Looking at the logs and trying to follow some reasoning is difficult. Weird decisions that don't make sense.</li>

Nostr notes by Ján Trenčanský

Agree, if we look at e.g. the leaked Conti manuals the TTPs there ...

First time I'm dealing with an incident where, at least in my ...