cowWhySo/permission-command-corpus huggingface dataset:
Command: remove-item "#{output_path}" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Enumerate All Network Shares with SharpShares
Notes: SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. 
This technique has been utilized by various ransomware groups, including BianLian.
[Reference](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)
Command: invoke-expression 'cmd /c start powershell -command { cmd /c "#{snaffler_path}" -a -o "#{output_path}" }; start-sleep 90; stop-process -name "snaffler"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1135
Platform: windows
ATT&CK tags: T1135
Source rule: Enumerate All Network Shares with Snaffler
Notes: Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. 
[Reference](https://unit42.paloaltonetworks.com/muddled-libra/)
Command: mkdir %temp%\T1119_command_prompt_collection >nul 2>&1 dir c: /b /s .docx | findstr /e .docx for /R c:\ %f in (*.docx) do copy /Y %f %temp%\T1119_command_prompt_collection
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Automated Collection Command Prompt
Notes: Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection
to see what was collected.
Command: del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Automated Collection Command Prompt
Notes: Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection
to see what was collected.
Command: New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force | Out-Null Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Automated Collection PowerShell
Notes: Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection
to see what was collected.
Command: Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Automated Collection PowerShell
Notes: Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection
to see what was collected.
Command: Get-Service > $env:TEMP\T1119_1.txt Get-ChildItem Env: > $env:TEMP\T1119_2.txt Get-Process > $env:TEMP\T1119_3.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Recon information for export with PowerShell
Notes: collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.
Command: Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Recon information for export with PowerShell
Notes: collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.
Command: sc query type=service > %TEMP%\T1119_1.txt doskey /history > %TEMP%\T1119_2.txt wmic process list > %TEMP%\T1119_3.txt tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Recon information for export with Command Prompt
Notes: collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.
Command: del %TEMP%\T1119_1.txt >nul 2>&1 del %TEMP%\T1119_2.txt >nul 2>&1 del %TEMP%\T1119_3.txt >nul 2>&1 del %TEMP%\T1119_4.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1119
Platform: windows
ATT&CK tags: T1119
Source rule: Recon information for export with Command Prompt
Notes: collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.
Command: del /f %temp%\T1036.007_masquerading.docx.exe > nul 2>&1 del /f %temp%\T1036.007_masquerading.pdf.exe > nul 2>&1 del /f %temp%\T1036.007_masquerading.ps1.exe > nul 2>&1 del /f %temp%\T1036.007_masquerading.xls.vbs > nul 2>&1 del /f %temp%\T1036.007_masquerading.xlsx.vbs > nul 2>&1 del /f %temp%\T1036.007_masquerading.png.vbs > nul 2>&1 del /f %temp%\T1036.007_masquerading.doc.ps1 > nul 2>&1 del /f %temp%\T1036.007_masquerading.pdf.ps1 > nul 2>&1 del /f %temp%\T1036.007_masquerading.rtf.ps1 > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.007
Platform: windows
ATT&CK tags: T1036.007
Source rule: File Extension Masquerading
Notes: download and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched.

e.g SOME_LEGIT_NAME.[doc,docx,xls,xlsx,pdf,rtf,png,jpg,etc.].[exe,vbs,js,ps1,etc] (Quartelyreport.docx.exe)
Command: crontab -l > /tmp/notevil echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux,macos
ATT&CK tags: T1053.003
Source rule: Cron - Replace crontab with referenced file
Notes: This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.
Command: crontab /tmp/notevil
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux,macos
ATT&CK tags: T1053.003
Source rule: Cron - Replace crontab with referenced file
Notes: This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.
Command: echo "#{command}" > /etc/cron.daily/#{cron_script_name} echo "#{command}" > /etc/cron.hourly/#{cron_script_name} echo "#{command}" > /etc/cron.monthly/#{cron_script_name} echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: macos,linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to all cron subfolders
Notes: This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command: rm /etc/cron.daily/#{cron_script_name} -f rm /etc/cron.hourly/#{cron_script_name} -f rm /etc/cron.monthly/#{cron_script_name} -f rm /etc/cron.weekly/#{cron_script_name} -f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: macos,linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to all cron subfolders
Notes: This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command: echo "#{command}" > /etc/cron.d/#{cron_script_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to /etc/cron.d folder
Notes: This test adds a script to /etc/cron.d folder configured to execute on a schedule.
Command: rm /etc/cron.d/#{cron_script_name} -f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to /etc/cron.d folder
Notes: This test adds a script to /etc/cron.d folder configured to execute on a schedule.
Command: echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to /var/spool/cron/crontabs/ folder
Notes: This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command: rm /var/spool/cron/crontabs/#{cron_script_name} -f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.003
Platform: linux
ATT&CK tags: T1053.003
Source rule: Cron - Add script to /var/spool/cron/crontabs/ folder
Notes: This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command: for bucket in "$(aws s3 ls | cut -d " " -f3)"; do aws s3api list-objects-v2 --bucket $bucket --output text; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1619
Platform: iaas:aws
ATT&CK tags: T1619
Source rule: AWS S3 Enumeration
Notes: This test will enumerate all the S3 buckets in the user account and lists all the files in each bucket.
Command: Remove-Item -Path "#{output_file}" -Force -erroraction silentlycontinue Write-Output "Removed #{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1619
Platform: iaas:azure
ATT&CK tags: T1619
Source rule: Azure - Enumerate Storage Account Objects via Shared Key authorization using Azure CLI
Notes: This test enumerates all existing storage accounts and tries to fetch for each account the contained storage account objects. The access to storage objects is only possible if Shared Key authorization is enabled (e.g this is the case per default for storage objects creaded by Azure Function Apps).

Requirements:
- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.
- The EntraID user must have the r
Command: remove-item #{output_file} -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1619
Platform: iaas:azure
ATT&CK tags: T1619
Source rule: Azure - Scan for Anonymous Access to Azure Storage (Powershell)
Notes: Upon successful execution, this test will test for anonymous access to Azure storage containers by invoking a web request and outputting the results to a file. 
The corresponding response could then be interpreted to determine whether or not the resource/container exists, as well as other information. 
See https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-2-attack-the-azure-storage-service
Command: import-module "PathToAtomicsFolder\..\ExternalPayloads\Invoke-EnumerateAzureBlobs.ps1" Invoke-EnumerateAzureBlobs -base #{base} -permutations "#{wordlist}" -outputfile "#{output_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1619
Platform: iaas:azure
ATT&CK tags: T1619
Source rule: Azure - Enumerate Azure Blobs with MicroBurst
Notes: Upon successful execution, this test will utilize a wordlist to enumerate the public facing containers and blobs of a specified Azure storage account. 
See https://www.netspi.com/blog/technical/cloud-penetration-testing/anonymously-enumerating-azure-file-resources/ .
Command: Invoke-WebRequest #{domain} -UserAgent "HttpBrowser/1.0" | out-null Invoke-WebRequest #{domain} -UserAgent "Wget/1.9+cvs-stable (Red Hat modified)" | out-null Invoke-WebRequest #{domain} -UserAgent "Opera/8.81 (Windows NT 6.0; U; en)" | out-null Invoke-WebRequest #{domain} -UserAgent "*<|>*" | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.001
Platform: windows
ATT&CK tags: T1071.001
Source rule: Malicious User Agents - Powershell
Notes: This test simulates an infected host beaconing to command and control. Upon execution, no output will be displayed. 
Use an application such as Wireshark to record the session and observe user agent strings and responses.

Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
Command: #{curl_path} -s -A "HttpBrowser/1.0" -m3 #{domain} >nul 2>&1 #{curl_path} -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain} >nul 2>&1 #{curl_path} -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain} >nul 2>&1 #{curl_path} -s -A "*<|>*" -m3 #{domain} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.001
Platform: windows
ATT&CK tags: T1071.001
Source rule: Malicious User Agents - CMD
Notes: This test simulates an infected host beaconing to command and control. Upon execution, no out put will be displayed. 
Use an application such as Wireshark to record the session and observe user agent strings and responses.

Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
Command: curl -s -A "HttpBrowser/1.0" -m3 #{domain} curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 #{domain} curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 #{domain} curl -s -A "*<|>*" -m3 #{domain}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1071.001
Platform: linux,macos
ATT&CK tags: T1071.001
Source rule: Malicious User Agents - Nix
Notes: This test simulates an infected host beaconing to command and control.
Inspired by APTSimulator - https://github.com/NextronSystems/APTSimulator/blob/master/test-sets/command-and-control/malicious-user-agents.bat
Command: try { Import-Module AzureAD -ErrorAction Ignore $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword Connect-AzureAD -Credential $Credential -ErrorAction Ignore > $null Remove-AzureADDomain -Name "#{domain_name}" -ErrorAction Ignore } catch {}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1484.002
Platform: azure-ad
ATT&CK tags: T1484.002
Source rule: Add Federation to Azure AD
Notes: Add a new federated domain to Azure AD using PowerShell.
The malicious domain to be federated must be configured beforehand (outside of the scope of this test):
    1. Open Azure Portal
    2. Add a new "custom domain name"
    3. Verify the domain by following instructions (i.e. create the requested DNS record)
Command: sc.exe stop #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: windows
ATT&CK tags: T1489
Source rule: Windows - Stop service using Service Controller
Notes: Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying
it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be
started by running the cleanup command.
Command: sc.exe start #{service_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: windows
ATT&CK tags: T1489
Source rule: Windows - Stop service using Service Controller
Notes: Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying
it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be
started by running the cleanup command.
Command: net.exe stop #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: windows
ATT&CK tags: T1489
Source rule: Windows - Stop service using net.exe
Notes: Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully."
will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be
started by running the cleanup command.
Command: net.exe start #{service_name} >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: windows
ATT&CK tags: T1489
Source rule: Windows - Stop service using net.exe
Notes: Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully."
will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be
started by running the cleanup command.
Command: taskkill.exe /f /im #{process_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: windows
ATT&CK tags: T1489
Source rule: Windows - Stop service by killing process
Notes: Stops a specified service killng the service's process.
This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated."
will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be
started by running the cleanup command.
Command: sudo systemctl stop #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Linux - Stop service using systemctl
Notes: Stops a specified service using the systemctl command.
Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Command: sudo systemctl start #{service_name} 2> /dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Linux - Stop service using systemctl
Notes: Stops a specified service using the systemctl command.
Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Command: sudo killall -SIGTERM #{process_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Linux - Stop service by killing process using killall
Notes: Stops a specified service by sending a SIGTERM signal to the linked process using the killall command.
Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Command: sudo kill -SIGTERM $(pgrep #{process_name})
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Linux - Stop service by killing process using kill
Notes: Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Command: sudo pkill -SIGTERM #{process_pattern}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Linux - Stop service by killing process using pkill
Notes: Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running.
Upon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill.
Stopped service can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Command: echo "e" > /proc/sysrq-trigger
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1489
Platform: linux
ATT&CK tags: T1489
Source rule: Abuse of linux magic system request key for Send a SIGTERM to all processes
Notes: Adversaries with root or sufficient privileges Send a SIGTERM to all processes, except for init. By writing 'e' to /proc/sysrq-trigger, they can forced kill all processes, except for init.
Command: net view /domain net view
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - net
Notes: Identify remote systems with net.exe.

Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.
Command: net group "Domain Computers" /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - net group Domain Computers
Notes: Identify remote systems with net.exe querying the Active Directory Domain Computers group.

Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.
Command: nltest.exe /dclist:#{target_domain}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - nltest
Notes: Identify domain controllers for specified domain.

Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.
Command: for /l %i in (#{start_host},1,#{stop_host}) do ping -n 1 -w 100 #{subnet}.%i
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - ping sweep
Notes: Identify remote systems via ping sweep.

Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.
Command: arp -a
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - arp
Notes: Identify remote systems via arp. 

Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.
Command: arp -a | grep -v '^?'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux,macos
ATT&CK tags: T1018
Source rule: Remote System Discovery - arp nix
Notes: Identify remote systems via arp.

Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.
Command: for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux,macos
ATT&CK tags: T1018
Source rule: Remote System Discovery - sweep
Notes: Identify remote systems via ping sweep.

Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.