On a Windows host with an existing authorized command-execution context, retrieve a payload over HTTP and execute it using one of the listed methods. The alternatives cover PowerShell script retrieval and in-memory invocation, CertUtil Base64 download/decode followed by execution, BITS download followed by execution, or Mshta remote scriptlet execution. These are alternatives, not a four-step sequence; they do not establish initial access or deliver a command launcher.
Variant:
Execute HTA via Mshta
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER