I suppose that all of you are aware of the hack of Kaspersky in June of 2015. In Kaspersky's report they say that the intrusion was noticed when one of their engineers tested a new detection tool and discovered an abnormality. In an Haaretz article about the incident they are talking about the hacking of a third party company and altering of their code which leads to this hack.
Is there anyone who have an idea about how Kaspersky manged to discover this kind of attack (the tool that they used, how they work, etc.) and how they managed to analyze it? What I'm looking for is the "howto" that can help each one of use to have a better understating of the first league game even three years after the incident!