RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. All rights reserved.24 Our Response: Increased PowerShell Visibility • Upgraded the environment to PowerShell 3.0 and enabled logging • Logging captured input/output, variable initialization, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30. All rights reserved.32 BONUS SLIDE: TOR backdoor (just because it’s cool) 33) 34) 34