https://www.blackhat.com/us-20/briefings/schedule/#my-cloud-is-apts-cloud-investigating-and-defending-office–20982