Boot or Logon Autostart Execution: Print Processors

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Indicator Removal: Clear Windows Event Logs

Clear Windows Event Logs to hide the activity of an intrusion.

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Modifies file permissions

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Drops file in System32 directory

Modifies termsrv.dll

Commonly used to allow simultaneous RDP sessions.