Attackers intending to maintain persistence in a network need to keep their tools and malware away from prying eyes. We regularly detect and identify systems compromised during campaigns, then acquire and analyze the tools and malware used in the attack. We are the prying eyes. Common mistakes made by attackers get their intrusions noticed, and their persistence removed. As a result, the attacker's tool or piece of malware finds its way into our instances of IDA Pro. In this talk we examine common mistakes made by attackers during targeted attacks. We also present approaches to remedy these mistakes. We will be releasing an open source tool that aims to thwart the identification of an attacker's tools or malware on a compromised system, and is thus, a response to incident response.