Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Suspicious use of NtSetInformationThreadHideFromDebugger