PowerShell 4104 Hunting
Command and Scripting Interpreter, PowerShell
Command and Scripting Interpreter, PowerShell
Scheduled Task, Scheduled Task/Job
Windows Management Instrumentation
Use Alternate Authentication Material, Pass the Ticket, Steal or Forge Kerberos Tickets, Kerberoasting, AS-REP Roasting
Query Registry