s custom payload, Meterpreter, for example is capable of residing purely in volatile memory, often leaving few residual traces on persistent storage, if any. After identifying an entry point such as social engineering (perhaps too high profile) or more likely