These activities may be difficult to identify for defenders due to the use of these things like:     PSEXEC to execute a program from remote system Schedule a remote task to execute back door or malicious code RDP or net use to connect to other hosts