(OriginalFileName:Cmd.Exe OR Image:\\cmd.exe) (CommandLine:Invoke\-UserHunter* OR CommandLine:Invoke\-ShareFinder* OR CommandLine:Invoke\-Kerberoast* OR CommandLine:Invoke\-SMBAutoBrute* OR CommandLine:Invoke\-Nightmare* OR CommandLine:zerologon* OR CommandLine:av_query*)