One of the last steps taken by an attacker will be to configure permanent access to a compromised system. However, the installation of a backdoor, installation of new processes, and changes to key…

One of the last steps taken by an attacker will be to configure permanent access to a compromised system. However, the installation of a backdoor, installation of new processes, and changes to key files could be very quickly detected by an administrator. What tool would assist the attacker in preventing the administrator from detecting changes to files, new processes that are running, or other signs that the system might have been compromised?