@jesse i had a high performance computer lab getting rolled by some LoL players when i worked for a university. they used a bootable ubuntu drive to make stickeys faceroll launch an admin-owned command shell. only endpoint vendor that identified this was #FireEye #HX cisco amp and palo alto oblivious.