====Good====

Operation Sharpshooter
Operation Spalax

====Bad====

TA0006
Rundll32
OS Credential Dumping
