cowWhySo/permission-command-corpus huggingface dataset:
Command: get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.011
Platform: windows
ATT&CK tags: T1574.011
Source rule: Service Registry Permissions Weakness
Notes: Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "C:\temp\AtomicRedteam.exe"
Command: reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.011
Platform: windows
ATT&CK tags: T1574.011
Source rule: Service ImagePath Change with reg.exe
Notes: Change Service registry ImagePath of a bengin service to a malicious file
Command: sc.exe delete #{weak_service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1574.011
Platform: windows
ATT&CK tags: T1574.011
Source rule: Service ImagePath Change with reg.exe
Notes: Change Service registry ImagePath of a bengin service to a malicious file
Command: cat #{bash_history_filename} | grep #{bash_history_grep_args} > #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.003
Platform: linux,macos
ATT&CK tags: T1552.003
Source rule: Search Through Bash History
Notes: Search through bash history for specifice commands we want to capture
Command: cat #{sh_history_filename} | grep #{sh_history_grep_args} > #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.003
Platform: linux
ATT&CK tags: T1552.003
Source rule: Search Through sh History
Notes: Search through sh history for specifice commands we want to capture
Command: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1125
Platform: windows
ATT&CK tags: T1125
Source rule: Registry artefact when application use webcam
Notes: [can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)
Command: reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1125
Platform: windows
ATT&CK tags: T1125
Source rule: Registry artefact when application use webcam
Notes: [can-you-track-processes-accessing-the-camera-and-microphone](https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072)
Command: $PathToAtomicsFolder\T1055.004\bin\x64\EarlyBird.exe -program "#{spawn_process_path}" -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.004
Platform: windows
ATT&CK tags: T1055.004
Source rule: EarlyBird APC Queue Injection in Go
Notes: Creates a process in a suspended state and calls QueueUserAPC WinAPI to add a UserAPC to the child process that points to allocated shellcode. 
ResumeThread is called which then calls NtTestAlert to execute the created UserAPC which then executes the shellcode.
This technique allows for the early execution of shellcode and potentially before AV/EDR can hook functions to support detection.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)
- References: 
  - https://www
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue Stop-Process -Name "#{spawn_process_name}" -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.004
Platform: windows
ATT&CK tags: T1055.004
Source rule: EarlyBird APC Queue Injection in Go
Notes: Creates a process in a suspended state and calls QueueUserAPC WinAPI to add a UserAPC to the child process that points to allocated shellcode. 
ResumeThread is called which then calls NtTestAlert to execute the created UserAPC which then executes the shellcode.
This technique allows for the early execution of shellcode and potentially before AV/EDR can hook functions to support detection.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)
- References: 
  - https://www
Command: $PathToAtomicsFolder\T1055.004\bin\x64\NtQueueApcThreadEx.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.004
Platform: windows
ATT&CK tags: T1055.004
Source rule: Remote Process Injection with Go using NtQueueApcThreadEx WinAPI
Notes: Uses the undocumented NtQueueAPCThreadEx WinAPI to create a "Special User APC" in the current thread of the current process to execute shellcode. 
Since the shellcode is loaded and executed in the current process it is considered local shellcode execution.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page per
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.004
Platform: windows
ATT&CK tags: T1055.004
Source rule: Remote Process Injection with Go using NtQueueApcThreadEx WinAPI
Notes: Uses the undocumented NtQueueAPCThreadEx WinAPI to create a "Special User APC" in the current thread of the current process to execute shellcode. 
Since the shellcode is loaded and executed in the current process it is considered local shellcode execution.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page per
Command: echo "#{pwd_for_encrypted_file}" | $which_gpg --batch --yes --passphrase-fd 0 --cipher-algo #{encryption_alg} -o #{encrypted_file_path} -c #{input_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using gpg (FreeBSD/Linux)
Notes: Uses gpg to encrypt a file
Command: rm #{encrypted_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using gpg (FreeBSD/Linux)
Notes: Uses gpg to encrypt a file
Command: $which_7z a -p#{pwd_for_encrypted_file} #{encrypted_file_path} #{input_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using 7z (FreeBSD/Linux)
Notes: Uses 7z to encrypt a file
Command: $which_7z e #{encrypted_file_path} rm #{encrypted_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using 7z (FreeBSD/Linux)
Notes: Uses 7z to encrypt a file
Command: which_ccencrypt=`which ccencrypt` cp #{root_input_file_path} #{cped_file_path}; $which_ccencrypt -T -K #{pwd_for_encrypted_file} #{cped_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using ccrypt (FreeBSD/Linux)
Notes: Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.
Command: rm #{cped_file_path}.cpt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using ccrypt (FreeBSD/Linux)
Notes: Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.
Command: which_openssl=`which openssl` $which_openssl genrsa -out #{private_key_path} #{encryption_bit_size} $which_openssl rsa -in #{private_key_path} -pubout -out #{public_key_path} $which_openssl rsautl -encrypt -inkey #{public_key_path} -pubin -in #{input_file_path} -out #{encrypted_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using openssl (FreeBSD/Linux)
Notes: Uses openssl to encrypt a file
Command: $which_openssl rsautl -decrypt -inkey #{private_key_path} -in #{encrypted_file_path} rm #{encrypted_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: linux
ATT&CK tags: T1486
Source rule: Encrypt files using openssl (FreeBSD/Linux)
Notes: Uses openssl to encrypt a file
Command: echo T1486 - Purelocker Ransom Note > %USERPROFILE%\Desktop\YOUR_FILES.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: PureLocker Ransom Note
Notes: building the IOC (YOUR_FILES.txt) for the PureLocker ransomware 
https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/
Command: del %USERPROFILE%\Desktop\YOUR_FILES.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: PureLocker Ransom Note
Notes: building the IOC (YOUR_FILES.txt) for the PureLocker ransomware 
https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/
Command: 7z a -p #{file_password} -mhe=on #{encrypted_file_name} #{input_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: macos
ATT&CK tags: T1486
Source rule: Encrypt files using 7z utility - macOS
Notes: This test encrypts the file(s) using the 7z utility
Command: rm #{encrypted_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: macos
ATT&CK tags: T1486
Source rule: Encrypt files using 7z utility - macOS
Notes: This test encrypts the file(s) using the 7z utility
Command: openssl enc #{encryption_option} -in #{input_file_path} -out #{output_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: macos
ATT&CK tags: T1486
Source rule: Encrypt files using openssl utility - macOS
Notes: This test encrypts the file(s) using the openssl utility
Command: rm #{output_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: macos
ATT&CK tags: T1486
Source rule: Encrypt files using openssl utility - macOS
Notes: This test encrypts the file(s) using the openssl utility
Command: Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text" # Create the test.txt file again in case prereqs failed cmd /c "`"C:\Program Files (x86)\GnuPG\bin\gpg.exe`" --passphrase 'SomeParaphraseBlah' --batch --yes -c `"#{File_to_Encrypt_Location}`""
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: Data Encrypted with GPG4Win
Notes: Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.
Command: Remove-Item -Path "#{File_to_Encrypt_Location}" -Force -ErrorAction SilentlyContinue Remove-Item -Path "#{File_to_Encrypt_Location}.gpg" -Force -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: Data Encrypted with GPG4Win
Notes: Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.
Command: ""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: Data Encrypt Using DiskCryptor
Notes: DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/. The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. It's important to note
Command: del $env:Userprofile\Desktop\akira_readme.txt del c:\test.*.akira
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1486
Platform: windows
ATT&CK tags: T1486
Source rule: Akira Ransomware drop Files with .akira Extension and Ransomnote
Notes: Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\
Command: bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.005
Platform: macos,linux
ATT&CK tags: T1546.005
Source rule: Trap EXIT
Notes: Launch bash shell with command arg to create TRAP on EXIT.
The trap executes script that writes to /tmp/art-fish.txt
Command: rm -f /tmp/art-fish.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.005
Platform: macos,linux
ATT&CK tags: T1546.005
Source rule: Trap EXIT
Notes: Launch bash shell with command arg to create TRAP on EXIT.
The trap executes script that writes to /tmp/art-fish.txt
Command: bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.005
Platform: macos,linux
ATT&CK tags: T1546.005
Source rule: Trap SIGINT
Notes: Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal.
The trap executes script that writes to /tmp/art-fish.txt
Command: dir /s c:\ >> #{output_file} dir /s "c:\Documents and Settings" >> #{output_file} dir /s "c:\Program Files\" >> #{output_file} dir "%systemdrive%\Users\*.*" >> #{output_file} dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> #{output_file} dir "%userprofile%\Desktop\*.*" >> #{output_file} tree /F >> #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: File and Directory Discovery (cmd.exe)
Notes: Find or discover files on the file system.  Upon successful execution, this test will output the results of all the data discovery commands to a specified file.
Command: del #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: File and Directory Discovery (cmd.exe)
Notes: Find or discover files on the file system.  Upon successful execution, this test will output the results of all the data discovery commands to a specified file.
Command: ls -recurse get-childitem -recurse gci -recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: File and Directory Discovery (PowerShell)
Notes: Find or discover files on the file system. Upon execution, file and folder information will be displayed.
Command: ls -a >> #{output_file} if [ -d /Library/Preferences/ ]; then ls -la /Library/Preferences/ > #{output_file}; fi; file */* *>> #{output_file} cat #{output_file} 2>/dev/null find . -type f ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/' locate * which sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: linux,macos
ATT&CK tags: T1083
Source rule: Nix File and Directory Discovery
Notes: Find or discover files on the file system

References:

http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/

https://perishablepress.com/list-files-folders-recursively-terminal/
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: linux,macos
ATT&CK tags: T1083
Source rule: Nix File and Directory Discovery
Notes: Find or discover files on the file system

References:

http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/

https://perishablepress.com/list-files-folders-recursively-terminal/
Command: cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > #{output_file} if [ -f /etc/mtab ]; then cat /etc/mtab >> #{output_file}; fi; find . -type f -iname *.pdf >> #{output_file} cat #{output_file} find . -type f -name ".*"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: linux,macos
ATT&CK tags: T1083
Source rule: Nix File and Directory Discovery 2
Notes: Find or discover files on the file system
Command: remove-item #{File_to_output} -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: Simulating MAZE Directory Enumeration
Notes: This test emulates MAZE ransomware's ability to enumerate directories using Powershell.
Upon successful execution, this test will output the directory enumeration results to a specified file, as well as display them in the active window.
See https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
Command: Start-Process "#{dirlister_path}" Start-Sleep -Second 4 Stop-Process -Name "DirLister"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: Launch DirLister Executable
Notes: Launches the DirLister executable for a short period of time and then exits.

Recently seen used by [BlackCat ransomware](https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/) to create a list of accessible directories and files.
Command: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: ESXi - Enumerate VMDKs available on an ESXi Host
Notes: An adversary uses the find command to enumerate vmdks on an ESXi host.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)
Command: findmnt -t nfs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: linux
ATT&CK tags: T1083
Source rule: Identifying Network Shares - Linux
Notes: If the system uses network file systems (e.g., NFS, CIFS), findmnt can help locate paths to remote shares.
Attackers may then attempt to access these shares for lateral movement or data exfiltration.
Command: Remove-Item -Path "#{output_file}" -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1083
Platform: windows
ATT&CK tags: T1083
Source rule: Recursive Enumerate Files And Directories By Powershell
Notes: Adversary attempting to discover and collect sensitive documents and archives
from a user’s system. The test recursively enumerates common user folders
(Documents, Downloads, Desktop, OneDrive) for file types of interest such as .pdf, .doc,
.docx, .xls, .xlsx, .txt, .zip, .rar, and .7z.
This behavior is similar to malware like LOSTKEYS used by COLDRIVER in January 2025,
where attackers perform targeted file discovery to support strategic intelligence collection https://www.zscaler.com/blogs/secu
Command: cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.002
Platform: windows
ATT&CK tags: T1021.002
Source rule: Map admin share
Notes: Connecting To Remote Shares
Command: New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.002
Platform: windows
ATT&CK tags: T1021.002
Source rule: Map Admin Share PowerShell
Notes: Map Admin share utilizing PowerShell
Command: "#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.002
Platform: windows
ATT&CK tags: T1021.002
Source rule: Copy and Execute File with PsExec
Notes: Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).
Command: cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.002
Platform: windows
ATT&CK tags: T1021.002
Source rule: Execute command writing output to local Admin Share
Notes: Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.
Command: mkdir $HOME/... cp $(which sh) $HOME/... $HOME/.../sh -c "echo #{test_message}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: macos,linux
ATT&CK tags: T1036.005
Source rule: Execute a process from a directory masquerading as the current parent directory
Notes: Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`)
Command: rm -f $HOME/.../sh rmdir $HOME/.../
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: macos,linux
ATT&CK tags: T1036.005
Source rule: Execute a process from a directory masquerading as the current parent directory
Notes: Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`)
Command: Add-Type -TypeDefinition @' public class Test { public static void Main(string[] args) { System.Console.WriteLine("tweet, tweet"); } } '@ -OutputAssembly "#{executable_filepath}" Start-Process -FilePath "#{executable_filepath}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: windows
ATT&CK tags: T1036.005
Source rule: Masquerade as a built-in system executable
Notes: Launch an executable that attempts to masquerade as a legitimate executable.
Command: Remove-Item -Path "#{executable_filepath}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: windows
ATT&CK tags: T1036.005
Source rule: Masquerade as a built-in system executable
Notes: Launch an executable that attempts to masquerade as a legitimate executable.