Incident Response FOR508
Persistent Presence
Shadow Persistence
Phantom in the Auth Packages
Running Malicious File - WSC