@thomasfuchs That description sounds (vaguely) like what Crowdstrike did. Hopefully this wasn't code running with high privileges without a full test environment.