All of these tools, with the exception of Mimikatz (which is almost always used maliciously), have legitimate uses. For example, PowerShell is widely used within enterprises and the vast majority of scripts are legitimate. Similarly, PsExec is frequently used by systems administrators. However, in this case, it was Thrip’s use of PsExec that drew our attention. Through advanced artificial intelligence and machine learning, TAA has trained itself to spot patterns of malicious activity. While PsExec itself may be innocuous, the way that it was being used here triggered an alert by TAA. In short, Thrip’s attempts at camouflage blew its cover