# Execution Phase of DanBot Malware

## Overview
After initial access via spear phishing, the execution of DanBot malware was successfully detected. DanBot is being executed to establish a foothold within the network.

## Key Findings
- **Execution Method**: Utilizes PowerShell scripts to evade traditional antivirus detection.
- **Obfuscation Techniques**: Employs code obfuscation to hinder analysis.
- **Immediate Actions**: System scans indicate multiple instances of DanBot running on critical servers.

## Next Steps
Investigate persistence mechanisms to understand how Lyceum maintains access to compromised systems.