From the server log:

He typed:

Then, a new line appeared. Not from the beacon.

The process was stomped . Alex had injected the Sliver shellcode into a paused instance of Windows Defender’s own MsMpEng.exe . A classic living-off-the-land move, but version 4.2.2 made it cleaner—the --skip-symbols flag eliminated debug artifacts, and the new armory plugin EvtxHunt had pre-cleaned any event log anomalies before they were written.