How do you feel about this options:
1. issue command - I am not yet classified as intruder. I have hacked myself an user account, the analyze program made it past the stealth so it knows I am here, but MAYBE not yet verified the valid accounts list. (I don't know the nature of exploit I used, so I could have logged on guest user, or something like that). either way if there is no alert yet, I'd like to issue him a command - send me the list of last 100 user logons. This should -> a) override his current action to check me while browsing for data giving me one more IP to act, b) give me the list of valid IDs, that I could use for spoofing.
2. encrypt my icon - confusing it -> giving me more time to act
3. browse through the processes for the security rating ID -> allowing me to spoof a turn off alert command.