In all our previous chapters, we assumed that any process on the target machine can initiate a session to the internet without any restrictions. Now, in many enterprise networks, they don't rely on the built-in Windows Firewall. Instead, they use an advanced host-based firewall to limit what process can initiate a session to the internet, just like how the access lists work. So, for instance, let's assume that the system administrator has allowed only some business-needed processes to access the internet. For example, let's say that the system administrator allowed the Windows update and the antivirus update, as well as the most common browsers, such as Chrome, Internet Explorer, and Firefox. So, only these processes are allowed to reach over the internet; any other process will be blocked. By implementing such a policy, our backdoor has no chance to survive since it won't be listed in the administrator list by default. Eventually, we don't get any shell to...