Cyberattack, Detection, Adversary Engagement, Threat Intelligence, Threat Informed Defense.
calls that enumerated a list of mounted and unmounted drives. The adversary pivoted back to the admin account and created three new VMs, all conforming to the local naming convention, and successfully logged into them from an internal IP address. One of these VMs was deleted on the same day.