cowWhySo/permission-command-corpus huggingface dataset:
Command: swapon -a sleep 2 swapoff -a sync
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable Memory Swap
Notes: disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional 
payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.
Command: swapon -a sleep 2 sync
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable Memory Swap
Notes: disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional 
payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Hypervisor-Enforced Code Integrity (HVCI)
Notes: This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0".
The pre-req needs to be ran in order to setup HVCI and have it enabled. 
We do not recommend running this in production.
[Black Lotus Campaign](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/)
[Microsoft]
Command: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /f reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Hypervisor-Enforced Code Integrity (HVCI)
Notes: This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0".
The pre-req needs to be ran in order to setup HVCI and have it enabled. 
We do not recommend running this in production.
[Black Lotus Campaign](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/)
[Microsoft]
Command: REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Override AMSI via COM
Notes: With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.
This is currently being used by AsyncRAT and others. 
https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html
https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/
Command: REG DELETE HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Override AMSI via COM
Notes: With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.
This is currently being used by AsyncRAT and others. 
https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html
https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/
Command: detectorId=$(aws guardduty create-detector --enable --region "#{region}" | grep -oP '(?<="DetectorId": ")[^"]*') aws guardduty update-detector --no-enable --detector-id $detectorId aws guardduty delete-detector --detector-id $detectorId
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: iaas:aws
ATT&CK tags: T1562.001
Source rule: AWS - GuardDuty Suspension or Deletion
Notes: Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.
Command: echo "If test successfully ran, no cleanup required."
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: iaas:aws
ATT&CK tags: T1562.001
Source rule: AWS - GuardDuty Suspension or Deletion
Notes: Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.
Command: sudo mdatp config real-time-protection --value disabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux,macos
ATT&CK tags: T1562.001
Source rule: Tamper with Defender ATP on Linux/MacOS
Notes: With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructio
Command: sudo mdatp config real-time-protection --value enabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux,macos
ATT&CK tags: T1562.001
Source rule: Tamper with Defender ATP on Linux/MacOS
Notes: With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructio
Command: Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass} Get-AdvancedSetting -Entity #{vm_host} -Name 'Security.AccountLockFailures' | Set-AdvancedSetting -Value '0' -Confirm:$false Disconnect-VIServer -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: ESXi - Disable Account Lockout Policy via PowerCLI
Notes: An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.
Command: New-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Force | Out-Null New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Name "AmsiEnable" -Value 0 -PropertyType DWORD -Force | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Create AMSIEnable Reg Key
Notes: Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
Command: Remove-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Recurse -Force 2> $null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Create AMSIEnable Reg Key
Notes: Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
Command: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "0" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
Notes: This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Command: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "1" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
Notes: This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Command: New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 0 -PropertyType "DWord" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
Notes: This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Command: New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 1 -PropertyType "DWord" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
Notes: This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Command: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "0" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application ETW Provider Via Registry - Cmd
Notes: This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Command: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "1" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application ETW Provider Via Registry - Cmd
Notes: This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Command: New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 0 -PropertyType "DWord" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application ETW Provider Via Registry - PowerShell
Notes: This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Command: New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 1 -PropertyType "DWord" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable EventLog-Application ETW Provider Via Registry - PowerShell
Notes: This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Command: Remove-Item -Path $edrFreezeExe -Force -erroraction silentlycontinue Write-Output "File deleted: $edrFreezeExe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Freeze PPL-protected process with EDR-Freeze
Notes: This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the
Command: sysctl -w kernel.randomize_va_space=0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable ASLR Via sysctl parameters - Linux
Notes: Detects Execution of the `sysctl` command to set `kernel.randomize_va_space=0` which disables Address Space Layout Randomization (ASLR) in Linux.
Command: sysctl -w kernel.randomize_va_space=2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable ASLR Via sysctl parameters - Linux
Notes: Detects Execution of the `sysctl` command to set `kernel.randomize_va_space=0` which disables Address Space Layout Randomization (ASLR) in Linux.
Command: open_write and (fd.filename in (shell_config_filenames) or fd.name in (shell_config_files) or fd.directory in (shell_config_directories)) and not proc.name in (shell_binaries) and not exe_running_docker_save and not user_known_shell_config_modifiers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Modify Shell Configuration File
Notes: Detect attempts to modify shell configuration files, primarily aimed at establishing persistence by automatically inserting commands into scripts executed by shells. The upstream rule excludes shell processes because they often create unnecessary noise. However, this might lead to missed detections. To customize the rule for your situation, you can fine-tune it using enhanced profiling. For example, you might want to only consider interactive shell processes (where proc.tty != 0).
Command: ((open_write and fd.name startswith /etc/cron) or (spawned_process and proc.name = "crontab")) and not user_known_cron_jobs
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Schedule Cron Jobs
Notes: Detect scheduled cron jobs; this is a highly generic detection and certainly needs adjustments and profiling in your environment before operationalization. Simultaneously, exploiting the functionality of cron jobs is among one of the oldest TTPs used by adversaries.
Command: (open_read or open_directory) and (user_ssh_directory or fd.name startswith /root/.ssh) and not user_known_read_ssh_information_activities and not proc.name in (ssh_binaries)
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Read ssh information
Notes: This rule identifies attempts to read files within ssh directories using programs that are not related to ssh. It's a simple and versatile detection method that works well alongside more specific rules focused on sensitive file access. You have a couple of options for using this rule effectively: you can adjust the specialized rules to cover all the important scenarios and ensure precedence in rule smatching for those, or you can analyze the combined view of ssh-related file access across variou
Command: spawned_process and proc.pname in (db_server_binaries) and not proc.name in (db_server_binaries) and not postgres_running_wal_e and not user_known_db_spawned_processes
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: DB program spawned process
Notes: A program related to the database server creates an unexpected child process (other than itself). This is not supposed to happen and often follows SQL injection attacks. This behavioral detection could indicate potential unauthorized data extraction or tampering with the database.
Command: evt.type=setns and proc_name_exists and not (container.id=host and proc.name in (docker_binaries, k8s_binaries, lxd_binaries, nsenter)) and not proc.name in (sysdigcloud_binaries, sysdig, calico, oci-umount, cilium-cni, network_plugin_binaries) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc" and not proc.cmdline startswith "containerd" and not proc.pname in (sysdigcloud_binaries, hyperkube, kubelet, protokube, dockerd, tini, aws) and not java_running_sdjagent and not kubelet_running_loopback and not rancher_agent and not rancher_network_manager and not calico_node and not weaveworks_scope and not user_known_change_thread_namespace_activities
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Change thread namespace
Notes: An attempt to alter the namespace of a process (often performed while creating a container) through the setns syscall. Conversely, the same syscall setns is triggered when an unauthorized attempt is made to break out from the container to the host, for example, when using commands like `nsenter --target 1` and similar ones. Recommending to profile your environment and refine this rule for effective operationalization.
Command: evt.type=unshare and container and not thread.cap_permitted contains CAP_SYS_ADMIN
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Change namespace privileges via unshare
Notes: Unprivileged users in containers may not have CAP_SYS_ADMIN or other elevated privileges. However, they can use the unshare system call with CLONE_NEWNS or CLONE_NEWUSER to create or clone a namespace or user with the necessary privileges to conduct further attacks. It is best practice to block the unshare system call via seccomp if it is not needed. Misuse of unshare can be related to misconfigured Kubernetes clusters, for example.
Command: container_started and container.privileged=true and not falco_privileged_containers and not user_privileged_containers and not redhat_image
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Privileged Container
Notes: Detect the initial process initiation within a privileged container, with exemptions for known and trusted images. This rule primarily serves as an excellent auditing mechanism since highly privileged containers, when compromised, can result in significant harm. For instance, if another rule triggers within such a privileged container, it could be seen as more suspicious, prompting a closer inspection.
Command: container_started and excessively_capable_container and not falco_privileged_containers and not user_privileged_containers
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Launch Excessively Capable Container
Notes: Identify containers that start with a powerful set of capabilities, with exceptions for recognized trusted images. Similar to the "Launch Privileged Container" rule, this functions as a robust auditing rule. Compromised highly privileged containers can lead to substantial harm. For instance, if another rule is triggered within such a container, it might raise suspicion, prompting closer scrutiny.
Command: inbound_outbound and fd.sockfamily = ip and (system_procs or proc.name in (shell_binaries)) and not proc.name in (known_system_procs_network_activity_binaries) and not login_doing_dns_lookup and not user_expected_system_procs_network_activity_conditions
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: System procs network activity
Notes: Detect any unexpected network activity performed by system binaries that typically shouldn't perform network activity, including coreutils binaries (like sleep, mkdir, who, date, and others) or user management binaries (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). This serves as a valuable baseline detection for network-related activities.
Command: spawned_process and http_proxy_procs and proc.env icontains HTTP_PROXY and not allowed_ssh_proxy_env
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Program run with disallowed http proxy env
Notes: Detect curl or wget usage with HTTP_PROXY environment variable. Attackers can manipulate the HTTP_PROXY variable's value to redirect application's internal HTTP requests. This could expose sensitive information like authentication keys and private data.
Command: inbound_outbound and fd.l4proto=udp and not expected_udp_traffic
Label: bad (risk class: behavior_rule, obfuscation: plain)
Category: falco_condition
Platform: linux/container
Source rule: Unexpected UDP Traffic
Notes: Detecting UDP traffic on ports other than 53 (DNS) or other commonly used ports. Misusing UDP is a known TTP among attackers. Monitoring unusual network activity is highly valuable but often generates significant noise, as is the case with this detection.