https://isc.sans.edu/diary/A+Use+Case+for+Adding+Threat+Hunting+to+Your+Security+Operations+Team+Detecting+Adversaries+Abusing+Legitimate+Tools+in+A+Customer+Environment+Guest+Diary/30816/