Evicting the Adversary | Huntress

This blog post explains how defenders can detect, investigate, and eject attackers from Windows Active Directory environments by identifying misuse of WinRM/PowerShell remoting, Impacket WMIexec, and RDP; it showcases monitoring artifacts and provides remediation actions (disabling accounts, rotating passwords, removing admin rights, and terminating sessions) while warning about the tradeoffs of alerting adversaries during response.