Endpoint-Monitoring

Adversaries may abuse the Telnet protocol to move laterally within a network, necessitating monitoring of internal Telnet connections to identify unauthorized remote access attempts.

Adversaries use the .NET CopyFromScreen method within PowerShell scripts to capture desktop screenshots for information gathering during post-compromise operations.