Establishing a baseline for detecting LOTL attacks in Windows operating systems