It was a Tuesday in late autumn when Lena Brandt got the call she'd been half-expecting for six months.
Lena ran the small internal security team at a regional freight and warehousing company — the kind of business that doesn't make headlines, but that quietly moves a great deal of other people's inventory through a great many trucks, ports, and loading docks. Forty-odd warehouses. A logistics platform stitched together over a decade by three different IT directors. And, as of that Tuesday morning, an acquisition offer from a much larger competitor that wanted to close the deal before the end of the quarter.
"They want a security review," her CIO told her over the phone. "Before due diligence goes final. Not a full audit — nobody has time for that — but they want to know if there's anything hiding in the walls."
Lena had heard that phrase before — anything hiding in the walls — and she knew exactly what it meant. Not viruses. Not phishing emails sitting in a quarantine folder. Something patient. Something that had already gotten in and simply hadn't been in a hurry to leave.
A Green Dashboard Doesn't Mean an Empty House
The company's endpoint protection dashboard looked, as it always did, calm. Green across the board. No alerts in the last six weeks that hadn't been resolved within the hour — mostly false positives from an aging PDF reader flagged by an overzealous heuristic engine. Lena had no reason to distrust the tool. It did exactly what it was built to do: watch for things that behaved like malware, in real time, as they happened.
But that was also its limitation, and she knew it. Real-time protection is built to catch an attack in the act — a process trying to encrypt files, a script trying to phone home, a binary that matches a known signature. It is not built to notice a piece of software that has been quietly present for months, using legitimate system tools, blending into the rhythm of normal administrative work. Security researchers have a term for that style of intrusion: living off the land — using what's already installed and trusted, rather than dropping anything a scanner would recognize as foreign.
And industry dwell-time figures backed up her unease. According to Mandiant's M-Trends reporting, attackers typically go undetected inside a compromised network for a median of around eleven days — longer still, often stretching into weeks, when the compromise is found by outsiders rather than the organization's own defenses. For attackers with patience rather than urgency — the kind interested in access and data rather than a quick payday — the real number could be measured in months.
Lena didn't think her company had been breached. But "I don't think so" was not the kind of sentence she wanted to put in front of a due-diligence team with lawyers attached to it.
Bringing In a Second Opinion
The acquiring company's security lead, a clipped and efficient man named Sven Kessler, arrived on-site on a Thursday with a laptop bag and, notably, no request for domain admin credentials.
"We're not going to install anything," he told Lena, in a tone that suggested he'd had this conversation many times before with nervous IT departments. "No agents. No new services running on your servers. We can't — the deal timeline doesn't allow it, and frankly, neither would you if I asked."
What he had instead was a single executable, a handful of rule files, and a USB drive.
The tool was THOR, built by the German security company Nextron Systems — a portable compromise-assessment scanner rather than a piece of protective software. Unlike an antivirus agent, it doesn't sit resident on a machine watching processes as they run. It's copied onto a system — from a USB stick, a network share, or a temporary folder — executed once with read access, and then removed, leaving nothing behind. It was built specifically for situations exactly like this one: incident response after a suspected breach, periodic assessments in environments too sensitive to touch, and — as it happened — due-diligence reviews where an acquirer needs an honest answer before writing a check.
Under the hood, THOR runs several different kinds of analysis in parallel. Tens of thousands of hand-curated YARA rules — a pattern-matching format widely used across the security industry to identify malicious files, memory artifacts, and known attacker tooling — are applied against the file system, running processes, and registry entries. Alongside that sits a set of Sigma rules, an open detection-rule standard for log analysis, which comb through Windows Event Logs looking for the behavioral fingerprints of an intrusion rather than a specific file. And running quietly underneath both is an anomaly layer: the kind of scanning that notices a file sitting in a folder where nothing should be named quite like that, or a hidden alternate data stream tucked onto an otherwise unremarkable document.
Sven pointed the scanner at the file servers first, then the two domain controllers still limping along from an IT restructuring three years prior. He didn't ask for anything special. He didn't need to.
What Three Hours Turned Up
The scan itself was almost anticlimactic to watch — a scrolling terminal window, file paths ticking past, most of it entirely uneventful. Lena made coffee. Sven answered emails. It was, for the first two hours, the security equivalent of watching paint dry.
Then, a little after eleven in the morning, something surfaced.
Buried in the Windows Task Scheduler on one of the domain controllers was an entry that, at a glance, looked entirely unremarkable — a name almost identical to the company's legitimate nightly backup verification job, differing by a single character most people would never notice unless they were looking for it. It ran on an irregular schedule, not nightly like its genuine counterpart, but every few days, always outside business hours.
THOR's Sigma-based log analysis flagged the pattern first: the scheduled task's creation history and execution footprint matched known signatures for a persistence technique — a method attackers use to make sure their access survives a reboot or a password reset without needing to re-compromise the system. The YARA layer, scanning the associated binary, added a second, independent flag: a partial match against rules built to catch tooling associated with data staging and exfiltration, the kind of software whose entire purpose is quietly copying files somewhere they don't belong.
What made the finding uncomfortable rather than merely interesting was what came next. Cross-referencing the task's outbound connection history against the event logs showed a small, steady trickle of archived files — compressed, and clearly intentionally so — being sent to an external IP address on no fixed schedule anyone in the company recognized. Nobody on Lena's team had built this. Nobody remembered approving it. And critically, none of it had ever triggered so much as a yellow warning on the endpoint protection dashboard she'd been checking every morning for years, because none of the individual pieces — a signed system utility, a scheduled task, an archive file, an outbound connection — looked malicious in isolation. Only in combination, viewed after the fact with the right rules applied, did the shape of it become visible.
Sven later put it plainly to the room, half to Lena and half to the deal team on a conference call: he'd tested a sample from a comparable case earlier that year and it had returned zero detections on VirusTotal, the widely used multi-engine scanning service — yet the same file had matched three separate custom detection rules once run through this kind of purpose-built scanner. It was, he said, less a knock against the antivirus industry than a reminder of what real-time signature matching is and isn't designed to catch. A tool built to look backward, deliberately, with rules crafted around how advanced intrusions actually behave, will sometimes see what a tool built to react in the moment cannot.
What Happened Next
The finding didn't collapse the acquisition. It reshaped it. What had been, that Tuesday morning, a straightforward pre-close checklist became a documented, time-stamped discovery that fed directly into the deal's final terms: a mandatory remediation window, an indemnity clause specific to the incident, and a joint forensic follow-up before either party would call the matter closed.
For Lena, the experience left a smaller but more personal mark. She'd spent years trusting a green dashboard to tell her the truth about her own network, and it had — as far as its design allowed it to. What it couldn't do was answer the question that mattered most in that particular week: not is something happening right now, but has something already happened, and are we the last to know.
It's a distinction that increasingly sits at the center of how mature security teams think about their own defenses — not as a replacement for the tools watching the front door in real time, but as a second, deliberately backward-looking layer that asks a different question entirely. Nextron also makes a free version of the same underlying scanner, THOR Lite, aimed at individual analysts who want the same rule-driven approach without an enterprise deployment behind it — proof that the core idea doesn't require a due-diligence deadline or a six-figure contract to be useful. Sometimes all it takes is someone willing to ask, before signing anything, what's actually been running quietly in the walls.
Here are the relevant links for Nextron Systems and THOR:
- Nextron Systems (official site): https://www.nextron-systems.com/
- THOR (full product page): https://www.nextron-systems.com/thor/
- THOR Lite (free version): https://www.nextron-systems.com/thor-lite/
- Valhalla (their YARA/Sigma rule feed): https://www.nextron-systems.com/valhalla/
- Florian Roth on GitHub: https://github.com/neo23x0
- Florian Roth on X: https://twitter.com/cyb3rops
- SigmaHQ (the open detection-rule standard Roth co-founded): https://github.com/SigmaHQ/sigma