Svchost LOLBAS Execution Process Spawn
Scheduled Task/Job, Scheduled Task
Scheduled Task/Job, Scheduled Task
Gather Victim Host Information
Process Injection, Dynamic-link Library Injection
Remote Services, Windows Remote Management
Transfer Data to Cloud Account