I don't understand how "we actively spy on our customers and blog about it" is a viable marketing strategy..?
replies(3):
> We knew this was an adversary, rather than a legitimate user, based on several telling clues. The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent.
So in any other context, they probably wouldn't do any digging into the machine or user history, but they did this time because they already had high confidence of malicious use from this endpoint.