cowWhySo/permission-command-corpus huggingface dataset:
Command: C:\Windows\System32\winlogon.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Wlrmdr.EXE Uncommon Argument Or Child Process
Notes: Sigma process_creation rule; status=experimental; level=medium
Command: C:\Program Files\Git\mingw64\bin\curl.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.command-and-control, attack.t1105
Source rule: Suspicious Curl.EXE Download
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files\Git\usr\bin\sh.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.command-and-control, attack.t1105
Source rule: Suspicious Curl.EXE Download
Notes: Sigma process_creation rule; status=test; level=high
Command: TpmVscMgr.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: New Virtual Smart Card Created Via TpmVscMgr.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: LODCTR.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: Rebuild Performance Counter Values Via Lodctr.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using Windows Media Player - Process
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files\Windows Media Player\osk.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using Windows Media Player - Process
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using Windows Media Player - Process
Notes: Sigma process_creation rule; status=test; level=high
Command: FINDSTR.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.collection, attack.t1119, attack.credential-access, attack.t1552.001
Source rule: Automated Collection Command Prompt
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\SysWOW64\setup16.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.persistence, attack.defense-evasion, attack.t1574.005
Source rule: Setup16.EXE Execution With Custom .Lst File
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\conhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.lateral-movement, attack.t1021.006
Source rule: Potential Lateral Movement via Windows Remote Shell
Notes: Sigma process_creation rule; status=experimental; level=medium
Command: 7z.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: 7za.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: CONHOST.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: Cmd.Exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: InstallUtil.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: WinRAR.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: net.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: net1.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: netsh.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: wevtutil.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Potential Defense Evasion Via Binary Rename
Notes: Sigma process_creation rule; status=test; level=medium
Command: popupwrapper.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.execution, attack.t1218, attack.t1553.005, attack.t1204.002
Source rule: Windows MSIX Package Support Framework AI_STUBS Execution
Notes: Sigma process_creation rule; status=experimental; level=low
Command: cscript.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059
Source rule: Script Interpreter Execution From Suspicious Folder
Notes: Sigma process_creation rule; status=test; level=high
Command: mshta.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059
Source rule: Script Interpreter Execution From Suspicious Folder
Notes: Sigma process_creation rule; status=test; level=high
Command: wscript.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059
Source rule: Script Interpreter Execution From Suspicious Folder
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\AppVClient.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055.001, attack.t1218.013
Source rule: Mavinject Inject DLL Into Running Process
Notes: Sigma process_creation rule; status=test; level=high
Command: net.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.discovery, attack.t1505.003, attack.t1018, attack.t1033, attack.t1087
Source rule: Webshell Detection With Command Line Keywords
Notes: Sigma process_creation rule; status=test; level=high
Command: net1.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.discovery, attack.t1505.003, attack.t1018, attack.t1033, attack.t1087
Source rule: Webshell Detection With Command Line Keywords
Notes: Sigma process_creation rule; status=test; level=high
Command: ping.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.discovery, attack.t1505.003, attack.t1018, attack.t1033, attack.t1087
Source rule: Webshell Detection With Command Line Keywords
Notes: Sigma process_creation rule; status=test; level=high
Command: wmic.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.discovery, attack.t1505.003, attack.t1018, attack.t1033, attack.t1087
Source rule: Webshell Detection With Command Line Keywords
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\SysWOW64\svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.005
Source rule: Suspicious Process Masquerading As SvcHost.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.005
Source rule: Suspicious Process Masquerading As SvcHost.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.005
Source rule: Suspicious Process Masquerading As SvcHost.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: BrowserCore.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.defense-evasion, attack.t1528, attack.t1036.003
Source rule: Renamed BrowserCore.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001, attack.collection, attack.t1114
Source rule: Exchange PowerShell Snap-Ins Usage
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\lsass.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.001
Source rule: Potential Credential Dumping Via WER
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\ComputerDefaults.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Tools Using ComputerDefaults
Notes: Sigma process_creation rule; status=test; level=high
Command: sdelete.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.impact, attack.t1485
Source rule: Potential File Overwrite Via Sysinternals SDelete
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\WINDOWS\System32\svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.execution, attack.persistence, attack.t1053.005, attack.t1059.001
Source rule: Potential Persistence Via Powershell Search Order Hijacking - Task
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\services.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: Always Install Elevated Windows Installer
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\ProgramData\chocolatey\choco.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027.004
Source rule: Dynamic .NET Compilation Via Csc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\ProgramData\chocolatey\tools\shimgen.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027.004
Source rule: Dynamic .NET Compilation Via Csc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\inetsrv\w3wp.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027.004
Source rule: Dynamic .NET Compilation Via Csc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\sdiagnhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027.004
Source rule: Dynamic .NET Compilation Via Csc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: --dump-bitlocker
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.002
Source rule: HackTool - Quarks PwDump Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: --dump-hash-domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.002
Source rule: HackTool - Quarks PwDump Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: --dump-hash-domain-cached
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.002
Source rule: HackTool - Quarks PwDump Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: --dump-hash-local
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.002
Source rule: HackTool - Quarks PwDump Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: --ntds-file
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential-access, attack.t1003.002
Source rule: HackTool - Quarks PwDump Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: AdFind.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1018, attack.t1087.002, attack.t1482, attack.t1069.002
Source rule: Renamed AdFind Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: mavinject32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055.001, attack.t1218.013
Source rule: Renamed Mavinject.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: mavinject64.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055.001, attack.t1218.013
Source rule: Renamed Mavinject.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.persistence, attack.privilege-escalation, attack.t1053.005, attack.s0111, car.2013-08-001, stp.1u
Source rule: Scheduled Task Creation Via Schtasks.EXE
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Program Files\Microsoft Office\root\integration\integrator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.persistence, attack.privilege-escalation, attack.t1053.005, attack.s0111, car.2013-08-001, stp.1u
Source rule: Scheduled Task Creation Via Schtasks.EXE
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Windows\SysWOW64\schtasks.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.persistence, attack.privilege-escalation, attack.t1053.005, attack.s0111, car.2013-08-001, stp.1u
Source rule: Scheduled Task Creation Via Schtasks.EXE
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Windows\System32\schtasks.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.persistence, attack.privilege-escalation, attack.t1053.005, attack.s0111, car.2013-08-001, stp.1u
Source rule: Scheduled Task Creation Via Schtasks.EXE
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\WINDOWS\system32\wbem\scrcons.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.privilege-escalation, attack.t1546.003
Source rule: WMI Persistence - Script Event Consumer
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.privilege-escalation, attack.t1546.003
Source rule: WMI Persistence - Script Event Consumer
Notes: Sigma process_creation rule; status=test; level=medium
Command: sdelete.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.impact, attack.t1485
Source rule: Renamed Sysinternals Sdelete Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\SysWOW64\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1070.001, attack.t1562.002, car.2016-04-002
Source rule: Suspicious Eventlog Clearing or Configuration Change Activity
Notes: Sigma process_creation rule; status=stable; level=high
Command: C:\Windows\System32\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1070.001, attack.t1562.002, car.2016-04-002
Source rule: Suspicious Eventlog Clearing or Configuration Change Activity
Notes: Sigma process_creation rule; status=stable; level=high
Command: C:\Windows\System32\OpenSSH\sshd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Program Executed Using Proxy/Local Command Via SSH.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1036.005, attack.t1055, attack.t1055.012
Source rule: Uncommon Svchost Command Line Parameter
Notes: Sigma process_creation rule; status=experimental; level=high
Command: /usr/bin/defaults
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1016
Source rule: System Network Discovery - macOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /bin/ls
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1083
Source rule: File and Directory Discovery - MacOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /tree
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1083
Source rule: File and Directory Discovery - MacOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /usr/bin/file
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1083
Source rule: File and Directory Discovery - MacOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /usr/bin/find
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1083
Source rule: File and Directory Discovery - MacOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /usr/bin/mdfind
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1083
Source rule: File and Directory Discovery - MacOS
Notes: Sigma process_creation rule; status=test; level=informational
Command: /usr/sbin/screencapture
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.collection, attack.t1113
Source rule: Screen Capture - macOS
Notes: Sigma process_creation rule; status=test; level=low
Command: /usr/bin/base64
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Decode Base64 Encoded Text -MacOs
Notes: Sigma process_creation rule; status=test; level=low
Command: /usr/bin/grep
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.discovery, attack.t1518.001
Source rule: Security Software Discovery - MacOs
Notes: Sigma process_creation rule; status=test; level=medium
Command: /usr/bin/security
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.credential-access, attack.t1555.001
Source rule: Credentials from Password Stores - Keychain
Notes: Sigma process_creation rule; status=test; level=medium
Command: /usr/sbin/firmwarepasswd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.impact
Source rule: Suspicious MacOS Firmware Activity
Notes: Sigma process_creation rule; status=test; level=medium
Command: /bin/launchctl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.defense-evasion, attack.t1562.001
Source rule: Disable Security Tools
Notes: Sigma process_creation rule; status=test; level=medium
Command: /usr/sbin/spctl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: macos
ATT&CK tags: attack.defense-evasion, attack.t1562.001
Source rule: Disable Security Tools
Notes: Sigma process_creation rule; status=test; level=medium
Command: /bin/dd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: linux
ATT&CK tags: attack.impact, attack.t1485
Source rule: DD File Overwrite
Notes: Sigma process_creation rule; status=test; level=low