Middle ground¶

The attacker is already inside. Now they need to stay, understand what they have, avoid looking like anything worth investigating, and move. Persistence mechanisms anchor the foothold; buffer overflows and reverse engineering extend it; steganography hides traffic in plain sight; cryptanalysis turns weak implementations into open doors; evasion makes sure none of it triggers an alert. The blue team’s challenge here is detecting behaviour that has been specifically designed not to look like behaviour, and doing it anyway.