A practical incident response guide focused on evicting adversaries from Windows environments in real time. Covers three attack vectors — PowerShell Remoting (WinRM), Impacket's WMIexec, and RDP — showing what each looks like from both attacker and defender perspectives. Provides specific PowerShell commands to identify active sessions, terminate attacker access, rotate credentials, disable compromised accounts, and remove group memberships. Also addresses the strategic timing challenge of eviction: acting too quickly tips off the adversary, potentially triggering ransomware or evidence destruction. Recommends first understanding initial access and persistence mechanisms before engaging.
