ScriptBlockText:Invoke\-DNSExfiltrator* OR (ScriptBlockText:\ \-i\ * ScriptBlockText:\ \-d\ * ScriptBlockText:\ \-p\ * ScriptBlockText:\ \-doh\ * ScriptBlockText:\ \-t\ *)