Well that escalated quickly: How a red team went from domain user to kernel memory

This report describes a red-team engagement in which a domain user with physical access to a host used PowerShell reconnaissance, compiled .NET modules, DLL load-order hijacking to create a local admin, and exploited a vulnerable signed Intel driver (CVE-2015-2291) to bypass driver signing and install a custom kernel-mode rootkit that disabled EDR and enabled credential theft; the detection, timeline, and investigation by the security team are documented.