Lateral Movement Artifact Analysis across Windows Hosts

Hard GIAC GCFA cybersecurity drill: You are tracing an attacker's lateral movement through a Windows domain. Common techniques include using PsExec, WMI