This trick is widely used by hackers to maintain persistent access to large enterprise networks. You can RDP around and press Shift 5 times to pop up the cmd.ex

This trick is widely used by hackers to maintain persistent access to large enterprise networks. You can RDP around and press Shift 5 times to pop up the cmd.exe on machines you've modified. No malware needed. Performing this modification DOES NOT require rebooting the computer into startup repair if you have admin access (which is typical after you get hacked). There is a process that watches system32 for modifications and resets them, but if you script it and change the files fast enough it won't notice. The utility of this trick is really insane. Would you realize that a hacker had backdoor access to your computer via RDP if the only thing that was modified was cmd.exe and sethc.exe swapping places?