24404ae40f
changed USER persistence method to EVENT to better describe technique removed "auditpol.exe /set /subcategory:Logon /failure:Enable" command from subscription_event method to be more opsec safe added CUSTOM_PS_COMMAND advanced option updated description to reflect changes