Compare the “5 whys” of root cause analysis to a correlary of “5 hows” to avoid getting caught. Ask “how can this be detected,” enough times to figure out how to bypass that detection, and you’ll eventually land in a gray area that isn’t easily detectable.
An example 🧵
DCSync.

— Tim McGuffin (@NotMedic) June 11, 2022