Triaging PowerShell Exploitation with Rekall
redblue.team