[MichaelBurge]

That's actually how it works though. See "Parallel Construction".

Except instead of saying "Access Denied" which immediately makes you suspicious and comment on the internet, they construct an alternative evidence chain so you waste your effort defending against the wrong thing, and the true techniques never come into question.