Offensive proof of concept
How the channel is built. Initial access, then a call-home path assembled entirely from tooling that already belongs on the machine — nothing compiled, nothing dropped, no signature for anything to match.
MARLEYNODE — when the intruder on your network is not a person.
An attacker takes a foothold and builds a call-home channel out of the administration tooling already on the box. Then an agent picks up the other end and works the network on its own — enumerating, harvesting credentials, moving sideways, pulling data out. The machine becomes a node on their network rather than yours.
TLP:AMBERRestricted distribution
Why it is different
Five properties, and the last two are what break the response plan
Autonomy
The operator is an agent. Decisions about where to go next are made without a person at the keyboard.
Scale
One operator is not one intrusion. The same channel pattern runs across every host it reaches.
Speed
Enumeration and lateral movement happen at machine pace, compressing the window a defender has to notice.
Persistence
The channel is ordinary administration traffic, so removing it means removing something that looks legitimate.
Stealth
No custom malware means nothing for signature-based tooling to flag. The behaviour is the only tell.
The series
Four documents, written for four different rooms
Detection proof of concept
What it leaves behind anyway. Where the behaviour separates from a real administrator, which telemetry carries the difference, and the detections that fire on it.
Briefing for the board
The same material without the shell transcripts. What changes when the operator is an agent rather than a person, what that does to response time, and the questions a board should be asking its own security function.
Defending against it
What the controls cost, in what order they are worth buying, and which of them a company already has and has not switched on.
Requesting the series
MARLEYNODE is marked TLP:AMBER, so it is shared with named people at named organisations rather than published. Tell us who you are and what you would use it for, and we will send the documents your role calls for — the board briefing on its own, or the full set including the offensive and detection work.