Traces of Windows remote command execution

https://www.synacktiv.com/publications/traces-of-windows-remote-command-execution.html