ScriptBlockText:WMImplant* OR ScriptBlockText:\ change_user\ * OR ScriptBlockText:\ gen_cli\ * OR ScriptBlockText:\ command_exec\ * OR ScriptBlockText:\ disable_wdigest\ * OR ScriptBlockText:\ disable_winrm\ * OR ScriptBlockText:\ enable_wdigest\ * OR ScriptBlockText:\ enable_winrm\ * OR ScriptBlockText:\ registry_mod\ * OR ScriptBlockText:\ remote_posh\ * OR ScriptBlockText:\ sched_job\ * OR ScriptBlockText:\ service_mod\ * OR ScriptBlockText:\ process_kill\ * OR ScriptBlockText:\ active_users\ * OR ScriptBlockText:\ basic_info\ * OR ScriptBlockText:\ power_off\ * OR ScriptBlockText:\ vacant_system\ * OR ScriptBlockText:\ logon_events\ *