GetWmiObject DS User with PowerShell Script Block
Domain Account, Account Discovery
Domain Account, Account Discovery
File and Directory Permissions Modification
Process Injection
Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild
Process Injection