Topic: Cybersecurity

Modern attackers increasingly rely on tools already present on the systems they compromise — PowerShell, WMI, scheduled tasks, RDP, and other built-in utilities that blend into normal administrative activity. This episode works through the LOLBin problem in three layers: the detection foundation (baselining tool usage and building appropriately scoped alerts), filtering legitimate from malicious usage by parent process, argument structure, and behavioral context, and the forensic reconstruction — the host artifacts that survive when SIEM telemetry is gone. Covers PowerShell ScriptBlock logs, WMI event subscriptions, scheduled task XML definitions, Shimcache, Amcache, prefetch, and RDP/SMB lateral movement artifacts, with Magnet Axiom Cyber for endpoint artifact analysis and Magnet Nexus for enterprise-wide scoping.