(Image:\\RemoteKrbRelay.exe OR OriginalFileName:RemoteKrbRelay.exe) OR (CommandLine:\ \-clsid\ * CommandLine:\ \-target\ * CommandLine:\ \-victim\ *) OR (CommandLine:\-rbcd\ * (CommandLine:\-cn\ * OR CommandLine:\-\-computername\ *)) OR (CommandLine:\-chp\ * (CommandLine:\-chpPass\ * CommandLine:\-chpUser\ *)) OR (CommandLine:\-addgroupmember\ * CommandLine:\-group\ * CommandLine:\-groupuser\ *) OR ((CommandLine:\-smb\ * CommandLine:\-\-smbkeyword\ *) (CommandLine:interactive* OR CommandLine:secrets* OR CommandLine:service\-add*))