A transit team debates dropping many binaries on a pivot host versus running tools remotely over an established tunnel. What footprint advantage can the tunnel approach offer?
Select an answer to reveal the explanation.
Short Explanation
Every binary you drop is another breadcrumb for the SOC—and for your own cleanup checklist. Running tools from your side over a tunnel can keep the pivot host less cluttered when that fits the job. Less litter on the floor, same ability to work.
Full Explanation
Mounting or invoking tooling across a tunnel can limit the number of binaries left on compromised hosts. Reducing on-host footprint simplifies cleanup and may lower noisy artifact volume when appropriate to the engagement. It is not universally mandatory, nor does it erase all forensic traces. Footprint awareness remains relevant during pivoting and tunneling phases.