ScriptBlockText:Add\-ConstrainedDelegationBackdoor* OR ScriptBlockText:Copy\-VSS* OR ScriptBlockText:Create\-MultipleSessions* OR ScriptBlockText:DataToEncode* OR ScriptBlockText:DNS_TXT_Pwnage* OR ScriptBlockText:Do\-Exfiltration\-Dns* OR ScriptBlockText:Download_Execute* OR ScriptBlockText:Download\-Execute\-PS* OR ScriptBlockText:DownloadAndExtractFromRemoteRegistry* OR ScriptBlockText:DumpCerts* OR ScriptBlockText:DumpCreds* OR ScriptBlockText:DumpHashes* OR ScriptBlockText:Enable\-DuplicateToken* OR ScriptBlockText:Enable\-Duplication* OR ScriptBlockText:Execute\-Command\-MSSQL* OR ScriptBlockText:Execute\-DNSTXT\-Code* OR ScriptBlockText:Execute\-OnTime* OR ScriptBlockText:ExetoText* OR ScriptBlockText:exfill* OR ScriptBlockText:ExfilOption* OR ScriptBlockText:FakeDC* OR ScriptBlockText:FireBuster* OR ScriptBlockText:FireListener* OR ScriptBlockText:Get\-Information\ * OR ScriptBlockText:Get\-PassHints* OR ScriptBlockText:Get\-Web\-Credentials* OR ScriptBlockText:Get\-WebCredentials* OR ScriptBlockText:Get\-WLAN\-Keys* OR ScriptBlockText:HTTP\-Backdoor* OR ScriptBlockText:Invoke\-AmsiBypass* OR ScriptBlockText:Invoke\-BruteForce* OR ScriptBlockText:Invoke\-CredentialsPhish* OR ScriptBlockText:Invoke\-Decode* OR ScriptBlockText:Invoke\-Encode* OR ScriptBlockText:Invoke\-Interceptor* OR ScriptBlockText:Invoke\-JSRatRegsvr* OR ScriptBlockText:Invoke\-JSRatRundll* OR ScriptBlockText:Invoke\-MimikatzWDigestDowngrade* OR ScriptBlockText:Invoke\-NetworkRelay* OR ScriptBlockText:Invoke\-PowerShellIcmp* OR ScriptBlockText:Invoke\-PowerShellUdp* OR ScriptBlockText:Invoke\-Prasadhak* OR ScriptBlockText:Invoke\-PSGcat* OR ScriptBlockText:Invoke\-PsGcatAgent* OR ScriptBlockText:Invoke\-SessionGopher* OR ScriptBlockText:Invoke\-SSIDExfil* OR ScriptBlockText:LoggedKeys* OR ScriptBlockText:Nishang* OR ScriptBlockText:NotAllNameSpaces* OR ScriptBlockText:Out\-CHM* OR ScriptBlockText:OUT\-DNSTXT* OR ScriptBlockText:Out\-HTA* OR ScriptBlockText:Out\-RundllCommand* OR ScriptBlockText:Out\-SCF* OR ScriptBlockText:Out\-SCT* OR ScriptBlockText:Out\-Shortcut* OR ScriptBlockText:Out\-WebQuery* OR ScriptBlockText:Out\-Word* OR ScriptBlockText:Parse_Keys* OR ScriptBlockText:Password\-List* OR ScriptBlockText:Powerpreter* OR ScriptBlockText:Remove\-Persistence* OR ScriptBlockText:Remove\-PoshRat* OR ScriptBlockText:Remove\-Update* OR ScriptBlockText:Run\-EXEonRemote* OR ScriptBlockText:Set\-DCShadowPermissions* OR ScriptBlockText:Set\-RemotePSRemoting* OR ScriptBlockText:Set\-RemoteWMI* OR ScriptBlockText:Shellcode32* OR ScriptBlockText:Shellcode64* OR ScriptBlockText:StringtoBase64* OR ScriptBlockText:TexttoExe*