HBGary Federal CEO Greg Hoglund spoke at the Kaspersky Lab Security Analysts Summit in Cancun, Mexico in February. He gave a talk on Lateral Movement and Other APT Interaction Patterns Within the Enterprise s. He offered some great insights into the art of tracking down remote access trojans (or RATs) after they have a foothold in your network, as well as the mistakes companies make in trying to prevent and respond to security incidents. The attacker will typically do things on the command line that are fully enumerated in Hacking Exposed.
Source: https://threatpost.com/hbgarys-greg-hoglund-art-rat-hunting-enterprise-031912/76342/