APT29 is the muse, but the evaluation is also about ensuring that products can detect "living off the land" techniques.