To achieve their objectives in our environment, attackers must move beyond their initial compromise and interact with our environment. Which means that we have the home field advantage - *if* we enable appropriate auditing and monitoring. This session will dig into some specific tactics that leverage that home field advantage and make it easier for us to effectively detect and respond.