| BH12227 | Deletes a scheduled task on a remote computer. | |
| BH12228 | Deletes a scheduled task. | |
| BH12244 | Disables a scheduled task. | |
| BH12245 | Disables a service. | |
| BH12268 | Disables the Diagnostics Tracking service. | |
| BH12280 | Disables the mouse and keyboard. | |
| BH12293 | Disables the user's ability to exit a script. | |
| BH12304 | Disconnect all sessions connected to this machine. | |
| BH12305 | Disconnect sessions from a given machine. | |
| BH12464 | Pauses a service. | |
| BH12586 | Stops a program started by a scheduled task on a remote computer. | |
| BH12587 | Stops a program started by a scheduled task. | |
| BH12737 | Tampers with system access control using .NET APIs. | |
| BH12745 | Tampers with Task Manager. | |
| BH12755 | Tampers with User Access Control. | |
| BH12786 | Tampers with Windows Update. | |
| BH12797 | Terminates running processes. | |
| BH12827 | Restricts user access to a single application. | |
| BH12879 | Disables a systemd service. | |
| BH18242 | Tampers with Windows Defender. | |
