cowWhySo/permission-command-corpus huggingface dataset:
Command: Start-Process "#{Splashtop_Path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Splashtop Execution
Notes: An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel.
Upon successful execution, Splashtop will be executed.
Command: Stop-Process -Name "strwinclt" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Splashtop Execution
Notes: An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel.
Upon successful execution, Splashtop will be executed.
Command: Start-Process -FilePath "C:Program Files (x86)\Splashtop\Splashtop Remote\Server\#{srserver_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Splashtop Streamer Execution
Notes: An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.
Command: Start-Process "shell:AppsFolder\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Microsoft App Quick Assist Execution
Notes: An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.
Command: Stop-Process -Name quickassist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1219
Platform: windows
ATT&CK tags: T1219
Source rule: Microsoft App Quick Assist Execution
Notes: An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.
Command: ping -n 4 #{ping_target}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.001
Platform: windows
ATT&CK tags: T1016.001
Source rule: Check internet connection using ping Windows
Notes: Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS).
Command: ping -c 4 #{ping_target}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.001
Platform: macos,linux
ATT&CK tags: T1016.001
Source rule: Check internet connection using ping freebsd, linux or macos
Notes: Check internet connection using ping on Linux, MACOS. The default target of the ping is 8.8.8.8 (Google Public DNS).
Command: Test-NetConnection -ComputerName #{target}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.001
Platform: windows
ATT&CK tags: T1016.001
Source rule: Check internet connection using Test-NetConnection in PowerShell (ICMP-Ping)
Notes: Check internet connection using PowerShell's Test-NetConnection cmdlet and the ICMP/Ping protocol. The default target is 8.8.8.8 (Google Public DNS).
Command: Test-NetConnection -CommonTCPPort HTTP -ComputerName #{target}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.001
Platform: windows
ATT&CK tags: T1016.001
Source rule: Check internet connection using Test-NetConnection in PowerShell (TCP-HTTP)
Notes: Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound HTTP (Port 80) access. The default target is www.google.com.
Command: Test-NetConnection -CommonTCPPort SMB -ComputerName #{target}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.001
Platform: windows
ATT&CK tags: T1016.001
Source rule: Check internet connection using Test-NetConnection in PowerShell (TCP-SMB)
Notes: Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound SMB (Port 445) access. The default target is 8.8.8.8.
Command: $Server=#{logonserver} $User = Join-Path #{domain} #{username} $Password="#{password}" cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password mstsc /v:$Server echo "RDP connection established"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: RDP to DomainController
Notes: Attempt an RDP session via Remote Desktop Application to a DomainController.
Command: $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: RDP to DomainController
Notes: Attempt an RDP session via Remote Desktop Application to a DomainController.
Command: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port} New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Changing RDP Port to Non Standard Port via Powershell
Notes: Changing RDP Port to Non Standard Port via Powershell
Command: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port} Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction Ignore Get-Service TermService | Restart-Service -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Changing RDP Port to Non Standard Port via Powershell
Notes: Changing RDP Port to Non Standard Port via Powershell
Command: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} /f netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Changing RDP Port to Non Standard Port via Command_Prompt
Notes: Changing RDP Port to Non Standard Port via Command_Prompt
Command: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} /f >nul 2>&1 netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1 net stop TermService /y >nul 2>&1 net start TermService >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Changing RDP Port to Non Standard Port via Command_Prompt
Notes: Changing RDP Port to Non Standard Port via Command_Prompt
Command: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 0 /t REG_DWORD /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Disable NLA for RDP via Command Prompt
Notes: Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt
Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
See also: https://github.com/
Command: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d #{Default_UserAuthentication} /t REG_DWORD -f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.001
Platform: windows
ATT&CK tags: T1021.001
Source rule: Disable NLA for RDP via Command Prompt
Notes: Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt
Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
See also: https://github.com/
Command: if (-not (Test-Path "#{file_to_delete}")) { New-Item "#{file_to_delete}" -Force } & "#{sdelete_exe}" -accepteula "#{file_to_delete}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: windows
ATT&CK tags: T1485
Source rule: Windows - Overwrite file with SysInternals SDelete
Notes: Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
the powershell session along with other information about the file that was deleted.
Command: dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: linux,macos
ATT&CK tags: T1485
Source rule: FreeBSD/macOS/Linux - Overwrite file with DD
Notes: Overwrites and deletes a file using DD.
To stop the test, break the command with CTRL/CMD+C.
Command: cipher.exe /w:C:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: windows
ATT&CK tags: T1485
Source rule: Overwrite deleted data on C drive
Notes: RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.
This process is very slow and test execution may timeout. 
https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4
Command: gcloud config set project #{project_id} gcloud storage buckets delete gs://#{bucket_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: iaas:gcp
ATT&CK tags: T1485
Source rule: GCP - Delete Bucket
Notes: This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.
This atomic will create a bucket then delete the bucket.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml
Command: cd "$PathToAtomicsFolder/T1485/src/T1485-4/" terraform state rm google_storage_bucket.bucket terraform destroy -auto-approve
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: iaas:gcp
ATT&CK tags: T1485
Source rule: GCP - Delete Bucket
Notes: This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.
This atomic will create a bucket then delete the bucket.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1485
Platform: windows
ATT&CK tags: T1485
Source rule: ESXi - Delete VM Snapshots
Notes: Deletes all snapshots for all Virtual Machines on an ESXi Host
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#inhibit%20recovery)
Command: "#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data for Exfiltration With Rar
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory
Command: del /f /q /s #{output_file} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data for Exfiltration With Rar
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory
Command: mkdir .\tmp\victim-files cd .\tmp\victim-files echo "This file will be encrypted" > .\encrypted_file.txt "#{rar_exe}" a -hp"blue" hello.rar dir
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data and lock with password for Exfiltration with winrar
Notes: Note: Requires winrar installation
rar a -p"blue" hello.rar (VARIANT)
Command: path=%path%;"C:\Program Files (x86)\winzip" mkdir .\tmp\victim-files cd .\tmp\victim-files echo "This file will be encrypted" > .\encrypted_file.txt "#{winzip_exe}" -min -a -s"hello" archive.zip * dir
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data and lock with password for Exfiltration with winzip
Notes: Note: Requires winzip installation
wzzip sample.zip -s"blueblue" *.txt (VARIANT)
Command: mkdir $PathToAtomicsFolder\T1560.001\victim-files cd $PathToAtomicsFolder\T1560.001\victim-files echo "This file will be encrypted" > .\encrypted_file.txt "#{7zip_exe}" u archive.7z *txt -pblue dir
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data and lock with password for Exfiltration with 7zip
Notes: Note: This test requires 7zip installation
Command: rmdir /s /Q $PathToAtomicsFolder\T1560.001\victim-files >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress Data and lock with password for Exfiltration with 7zip
Notes: Note: This test requires 7zip installation
Command: zip #{output_file} #{input_files}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Compressed - nix - zip
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.
Command: rm -f #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Compressed - nix - zip
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.
Command: test -e #{input_file} && gzip -k #{input_file} || (echo '#{input_content}' >> #{input_file}; gzip -k #{input_file})
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Compressed - nix - gzip Single File
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
Command: rm -f #{input_file}.gz
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Compressed - nix - gzip Single File
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
Command: tar -cvzf #{output_file} #{input_file_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Compressed - nix - tar Folder or File
Notes: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
Command: mkdir -p #{test_folder} cd #{test_folder}; touch a b c d e f g zip --password "#{encryption_password}" #{test_folder}/#{test_file} ./* echo "#{encryption_password}" | gpg --batch --yes --passphrase-fd 0 --output #{test_folder}/#{test_file}.zip.gpg -c #{test_folder}/#{test_file}.zip ls -l #{test_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Encrypted with zip and gpg symmetric
Notes: Encrypt data for exiltration
Command: rm -Rf #{test_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Data Encrypted with zip and gpg symmetric
Notes: Encrypt data for exiltration
Command: zip -r #{input_folder}/#{input_file}.zip #{input_folder} openssl enc -aes-256-cbc -pass pass:#{enc_pass} -p -in #{input_folder}/#{input_file}.zip -out #{input_folder}/#{input_file}.enc cat #{input_folder}/#{input_file}.enc | base64
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Encrypts collected data with AES-256 and Base64
Notes: An adversary may compress all the collected data, encrypt and send them to a C2 server using base64 encoding. 
This atomic test tries to emulate the behaviour of the FLEXIROOT backdoor to archive the collected data. FLEXIROOT typically utilizes AES encryption and base64 encoding to transfer the encrypted data to the C2 server. 
In this test, standard zip compression and the OpenSSL library are used to encrypt the compressed data.
https://attack.mitre.org/versions/v7/software/S0267/
Command: rm -rf #{input_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: linux,macos
ATT&CK tags: T1560.001
Source rule: Encrypts collected data with AES-256 and Base64
Notes: An adversary may compress all the collected data, encrypt and send them to a C2 server using base64 encoding. 
This atomic test tries to emulate the behaviour of the FLEXIROOT backdoor to archive the collected data. FLEXIROOT typically utilizes AES encryption and base64 encoding to transfer the encrypted data to the C2 server. 
In this test, standard zip compression and the OpenSSL library are used to encrypt the compressed data.
https://attack.mitre.org/versions/v7/software/S0267/
Command: # Re-add the initially extracted IP #{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m c:\temp\loghost_ip.txt rm c:\temp\loghost_ip.txt rm c:\temp\loghost.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: ESXi - Remove Syslog remote IP
Notes: An adversary may edit the syslog config to remove the loghost in order to prevent or redirect logs being received by SIEM.
Command: makecab.exe #{input_file} #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress a File for Exfiltration using Makecab
Notes: An adversary may compress data using Makecab (in-built Windows binary) that is collected prior to exfiltration.
[reference](https://unit42.paloaltonetworks.com/exchange-server-credential-harvesting/)
Command: del #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1560.001
Platform: windows
ATT&CK tags: T1560.001
Source rule: Compress a File for Exfiltration using Makecab
Notes: An adversary may compress data using Makecab (in-built Windows binary) that is collected prior to exfiltration.
[reference](https://unit42.paloaltonetworks.com/exchange-server-credential-harvesting/)
Command: sudo sh -c 'echo #{path_to_shared_library} > /etc/ld.so.preload'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.006
Platform: linux
ATT&CK tags: T1574.006
Source rule: Shared Library Injection via /etc/ld.so.preload
Notes: This test adds a shared library to the `ld.so.preload` list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.
Command: sudo sed -i 's##{path_to_shared_library}##' /etc/ld.so.preload
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.006
Platform: linux
ATT&CK tags: T1574.006
Source rule: Shared Library Injection via /etc/ld.so.preload
Notes: This test adds a shared library to the `ld.so.preload` list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.
Command: LD_PRELOAD=#{path_to_shared_library} ls
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.006
Platform: linux
ATT&CK tags: T1574.006
Source rule: Shared Library Injection via LD_PRELOAD
Notes: This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.
Command: DYLD_INSERT_LIBRARIES=#{dylib_file} #{file_to_inject}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.006
Platform: macos
ATT&CK tags: T1574.006
Source rule: Dylib Injection via DYLD_INSERT_LIBRARIES
Notes: injects a dylib that opens calculator via env variable
Command: kill `pgrep Calculator` kill `pgrep firefox`
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.006
Platform: macos
ATT&CK tags: T1574.006
Source rule: Dylib Injection via DYLD_INSERT_LIBRARIES
Notes: injects a dylib that opens calculator via env variable
Command: New-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components" -Name "atomic_test" -Force Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "(Default)" "ART TEST" -Force Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "StubPath" "#{payload}" -Force & $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.014
Platform: windows
ATT&CK tags: T1547.014
Source rule: HKLM - Add atomic_test key to launch executable as part of user setup
Notes: This test will create an "atomic_test" key under 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components' to launch calc by configuring an active setup executable and 
forcing to run active setup using the "runonce.exe /AlternateShellStartup" command. 
Without the "runonce.exe /AlternateShellStartup" command it would run during the next logon for each user.

Note: If you logout before running the cleanup command, you will be required to go through the OOBE (out-of-box experience) setup seque