Mimic Review: Kernel-Level Ransomware Defense (Q&A with Bob Blakley)

An attacker logs in with a stolen domain admin credential. Every tool in your stack sees a legitimate administrator using approved tools. What stops that person from killing your backup