I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat).
Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the techniques I've found used by intruders are for the most network break-ins, malware based break in through emails sended to employees of the company or and then steal passwords and break in managed exploiting very old vulnerability on unpatched server.
I've never found Covert Channel or Kernel Rootkit. And for the most part all the backdoors and tools used by the intruders were left in clear on the file system.
What is your experience with incident? Have you found some advanced techniques used by intruders or for the most all break in are maded by using simple and old techniques?