Volt Typhoon LOTL Detection: PowerShell and AD Abuse

Abstract Volt Typhoon sat inside U.S. critical infrastructure networks for at least five years, running almost entirely on tools already sitting on the box. CISA's advisory (AA24-038A) does note that