RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. All rights reserved.23 Our Response: Tackled Attacker WMI Usage ADVANCED ATTACK TECHNIQUES 24) 24. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.28 BONUS SLIDE: Even More WMI + PS 29) 29. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30. All rights reserved.32 BONUS SLIDE: TOR backdoor (just because it’s cool) 33) 34) 34