Based on some old siem alerts, you have been asked to perform some forensic analysis on a particular host. you have noticed that some ssl network connections are occurring over ports other than port 443. additionally, the siem alerts state that copies of svchost. exe and cmd. exe have been found in the %temp% folder on the host, as well as showing that rdp connections have previously connected with an ip address that is external to the corporate intranet. what threat might you have uncovered during your analysis?