Guided LabConstructed
Guided lab: a service that existed for nine seconds
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
T1021.002T1569.002