Hacker News new | ask | show | jobs
by Toast_25 3018 days ago
I think they're only looking for 2-5 IOC because they're checking the same machine they've broken into for operations.

Maybe they're looking for tools the other groups use to establish initial beachheads and not tools that are used for exploitation, info gathering or other more involved tasks.