Skip to content

Tagged: #capabilities

← Back to all snippets
Credential access, discovery, and capability boundaries
Explain credential-related capabilities by separating access, representation, use, and outcome, without confusing discovery with privilege gain.
capabilitiesmalware-internalslessons
Privilege escalation and lateral movement boundaries
Distinguish a change in permissions from a change in execution location and explain the evidence required for each.
capabilitiesmalware-internalslessons
Ransomware: data lifecycle, keys, and impact
Explain ransomware-related implementation boundaries and distinguish changed data, encryption claims, recoverability, and confirmed impact.
capabilitiesmalware-internalslessons